OWASP published their first MCP security framework. 30 CVEs in 60 days, 38% of servers without authentication, and a STDIO vulnerability affecting every official SDK. I walked through all 10 risks.
38% of MCP servers have no auth -- inside the OWASP MCP Top 10