Bring OWASP GenAI Security Project research directly into your AI agent/assistant using the Model Context Protocol (MCP).
The GenAI Security Advisor MCP Server gives MCP-compatible AI assistants access to the OWASP GenAI Security Project's curated security research without requiring you to download or maintain the research repository locally.
Connect the server to your MCP-compatible AI agent/assistant or application, then ask GenAI security questions as part of your normal workflow.
Use the GenAI Security Advisor MCP Server when you want your AI assistant to find and use OWASP GenAI Security Project research while helping you analyze, design, build, or secure Generative AI applications.
For example, you can ask:
What are the key security risks for an AI agent that can call tools?
What OWASP guidance applies to prompt injection?
Find OWASP GenAI Security Project research related to MCP security.
What security controls should I consider when an LLM can access sensitive enterprise data?
You can also provide your own architecture, application requirements, code, or security scenario and ask your AI assistant to use OWASP research when analyzing it.
For example:
Review this AI agent architecture and identify the relevant OWASP GenAI security risks and recommended mitigations.
The MCP server provides access to the research corpus. Your AI assistant can then use that research as context when answering your questions.
General-purpose AI models may not always contain the latest OWASP GenAI Security Project research in their built-in knowledge.
The MCP Server gives your AI assistant access to a curated collection of OWASP GenAI Security Project resources.
Your AI assistant can use the server to:
- Search GenAI security research
- Discover relevant OWASP resources
- Browse research by initiative
- Read individual research documents
- Retrieve resource and source information
- Incorporate OWASP research into its answers
The MCP Server accesses the same research corpus used by the GenAI Security Advisor Agent Skill, but makes that research available remotely through MCP.
You need an AI assistant, agent, development environment, or application that supports the Model Context Protocol (MCP) and remote MCP servers using Streamable HTTP.
Because the GenAI Security Advisor is a remote MCP server, you do not need to clone the research repository or install the corpus locally.
The MCP endpoint follows this format:
https://<server-address>/mcp
Add this endpoint to your MCP-compatible client.
For example, with Claude Code:
claude mcp add --transport http genai-security-advisor https://<server-address>/mcpReplace <server-address> with the address of the GenAI Security Advisor MCP Server deployment you want to use.
Once connected, your AI assistant should discover the GenAI Security Advisor tools automatically.
Once connected, you normally don't need to call individual MCP tools yourself.
Ask your AI assistant questions naturally and tell it to use the GenAI Security Advisor or OWASP GenAI Security Project research when appropriate.
Search the OWASP GenAI Security Project research for guidance on prompt injection.
What OWASP GenAI resources address agentic AI security?
What resources are available from the OWASP GenAI Security Project's Agentic Security initiative?
Search the OWASP GenAI Security Project corpus for MCP security risks and recommended controls.
I'm building an AI agent that can access internal databases and call external APIs.
Use OWASP GenAI Security Project research to identify the primary security risks and recommended mitigations.
What OWASP GenAI Security Project guidance applies when an AI agent can execute tools with elevated permissions?
The MCP Server provides several tools that your AI assistant can use automatically.
| Tool | What It Does |
|---|---|
search_corpus |
Searches OWASP GenAI Security Project research for relevant content |
list_resources |
Discovers resources in the research corpus |
list_initiatives |
Shows available initiatives and their resources |
get_resource |
Retrieves information and available files for a specific resource |
get_file |
Reads supported research files |
In most cases, you do not need to invoke these tools manually.
Your AI assistant can determine which tools to use based on your question.
The more context you provide, the more useful the security analysis can be.
Instead of asking:
How do I secure AI?
Try:
I'm designing an enterprise AI agent that can retrieve confidential documents and call internal APIs.
Search the OWASP GenAI Security Project research for security risks relevant to this architecture. Organize the findings by risk and include recommended mitigations.
Useful context can include:
- Type of AI application
- Whether the application uses AI agents
- Models being used
- Tools or APIs available to the model
- Data accessible to the model
- Authentication and authorization model
- MCP servers being used
- Trust boundaries
- Deployment architecture
- Security requirements
- Relevant application code
For security decisions, ask your AI assistant to identify the OWASP resources supporting its recommendations.
For example:
Which OWASP GenAI Security Project resources support these recommendations?
or:
For each security risk, identify the OWASP resource that discusses it.
or:
Separate recommendations derived from OWASP GenAI Security Project research from your general security recommendations.
This makes it easier to understand which guidance comes from the OWASP research corpus.
Some OWASP GenAI Security Project resources are published as PDFs.
To make these resources searchable, text may be extracted from the original PDFs and made available to the MCP search capability.
These text extractions are intended for search and discovery.
They may not preserve:
- Tables
- Diagrams
- Page layout
- Formatting
- Other visual information
When accuracy or citation is important, refer to the original OWASP source document rather than relying exclusively on extracted PDF text.
There are two ways to give an AI agent access to the GenAI Security Advisor research corpus.
| MCP Server | Agent Skill | |
|---|---|---|
| Best for | Remote access | Local repository access |
| Repository required locally | No | Yes |
| MCP support required | Yes | No |
| Access | Remote HTTP | Local |
| Research corpus | OWASP GenAI Security Project corpus | Same corpus |
You want an MCP-compatible AI assistant or application to access the research remotely without maintaining the research repository locally.
You are working with an AI coding agent that already has the GenAI Security Advisor repository available locally.
The GenAI Security Advisor MCP Server provides read-only access to security research.
Its tools are designed to:
- Search research
- Discover resources
- Retrieve resource information
- Read research content
The MCP server does not provide tools for modifying the OWASP research corpus.
As with any MCP server, your MCP client or AI assistant determines what information is included in tool requests.
Follow your organization's policies when connecting AI assistants to external MCP servers, particularly when working with confidential application information, source code, credentials, or other sensitive data.
The GenAI Security Advisor is part of the OWASP GenAI Security Project and welcomes community participation.
For questions about connecting to the MCP server, using the GenAI Security Advisor, MCP client compatibility, research resources, troubleshooting, feature ideas, or contributing, join the OWASP GenAI Security Project community and visit:
#team-genai-security-advisor
Contributions are welcome, including improvements to:
- MCP functionality
- Search and resource discovery
- Documentation
- Usage examples
- MCP client compatibility
- New capabilities
The MCP server's code, configuration, scripts, and documentation are licensed under Apache-2.0.
Research made available through the server retains the license of the original OWASP GenAI Security Project resource.
Much of the OWASP GenAI Security Project research is licensed under CC BY-SA 4.0.
Review the applicable source and licensing information before redistributing research retrieved through the server.
- OWASP GenAI Security Project
- GenAI Security Advisor
- GenAI Security Advisor MCP Server
- Model Context Protocol
- Use an AI assistant that supports MCP.
- Add the GenAI Security Advisor MCP endpoint.
- Verify that the server is connected.
- Ask your GenAI security question.
- Tell your assistant to use OWASP GenAI Security Project research.
- Ask it to identify the supporting OWASP resources.
Example:
Use the OWASP GenAI Security Project research available through the GenAI Security Advisor MCP Server to identify the key security risks in this AI agent architecture and recommend mitigations.
Connect once. Ask questions in your normal AI workflow. Bring OWASP GenAI Security Project research directly into your AI security analysis.