We Scanned 39 AI Agent Frameworks Against OWASP Agentic AI Top 10 -- Here Are The Results

#security #ai #opensource #webdev

We ran OWASP Agentic AI Top 10 security assessments against 39 agent frameworks. The results:

13 FAIL -- AutoGPT (risk 65), Open Interpreter (80), MetaGPT (50), Browser Use (60), OpenHands (70)...
17 WARN -- LangChain (26), CrewAI (23), Microsoft AutoGen (23), n8n (26)...
9 PASS -- Anthropic Claude SDK (0), Vercel AI SDK (0), LlamaIndex (3)...

Full scan results for all 39 agents: mcp-secure.dev/#registry

The Problem

MCP (Model Context Protocol) has no identity layer. No message signing. No tool integrity verification. 41% of MCP servers have zero authentication (TapAuth research). CVE-2025-6514 scored CVSS 9.6.

The Solution: MCPS

We built MCPS (MCP Secure) -- a cryptographic security layer for MCP. Think TLS for HTTP:

Agent Passports -- signed identity credentials for every agent
Message Signing -- every JSON-RPC call wrapped in a signed envelope
Tool Integrity -- signed definitions prevent poisoning
Replay Protection -- nonce + timestamp window
Trust Levels L0-L4 -- enforce minimum trust per server
Real-time Revocation -- blacklist compromised agents instantly

Mitigates 8 of 10 OWASP MCP risks. MIT licensed. Zero dependencies.

Install

npm install mcp-secure
pip install mcp-secure

Background

This came from filing OWASP security assessments against LangChain and other major frameworks. The LangChain community implemented AST filtering fixes based on the findings. That work led to building MCPS as the protocol-level fix.

Would love to hear your thoughts -- especially if you're building with MCP.