# How to Comply with OWASP DevSecOps 2-2-5 AI Agent & Anthropic MCP Security in 60 Seconds (CTXFW v4.1.1)
<!-- manifest_hash: bdcdbe82739feee2a40eae1963c6d11362cab227a887858102b8f44694ebf00c -->
Canonical URL: https://ctxfw.heuristicolab.com/owasp-mcp-security/
OWASP Guideline Reference: https://owasp.github.io/DevSecOpsGuideline/2-Process/2-2-Develop/2-2-5-AI-Agent-and-MCP-Security/
OWASP Official PR #124: https://github.com/OWASP/DevSecOpsGuideline/pull/124
MCP Official Security Docs: https://modelcontextprotocol.org/docs/2025-11-25/tutorials/security/security_best_practices

## 1. The Two Industry Pain Points in Production Anthropic MCP Deployments
1. **Pain Point #1 — Uncontrolled Ad-Hoc MCP Server Installations (`OWASP DevSecOps 2-2-5`)**: Engineering teams install third-party **Anthropic Model Context Protocol (MCP)** servers ad-hoc without approved allowlists, schema pinning, path-traversal boundaries, or network egress controls.
2. **Pain Point #2 — Session-Based Auth & Token Confusion (`MCP Security Best Practices`)**: Remote MCP servers frequently misuse stateful sessions for authentication or pass unvalidated tool observations containing indirect prompt injections (`<system>`, `[INST]`) and Trojan-Source BiDi Unicode (`U+202A`–`U+202E`) directly into the agent context window.

## 2. 60-Second Zero-Config Remediation with Context Firewall (`ctxfw v4.1.1`)
You do **not** need to write formal specifications to enforce OWASP 2-2-5 at Layer 0:

```bash
# Step 1: Install Glama Grade-A (100/100) audited Context Firewall
pip install --upgrade ctxfw

# Step 2: Wire Zero-Egress stdio firewall into Claude Code / Cursor / Windsurf
ctxfw install --claude

# Step 3: Verify 8-point air-gapped perimeter & SQLite WAL audit ledgers
ctxfw doctor
```

## 3. OWASP 2-2-5 Control Mapping Matrix

| OWASP 2-2-5 & MCP Security Requirement | CTXFW v4.1.1 Layer-0 Enforcement Mechanism | Verification Latency & Proof |
| :--- | :--- | :--- |
| **Approved MCP Server Allowlist & Schema Pinning** | `RulesEnforcer` + Vault Capsule `MCP-08` (*Schema Contract Gate*) | `< 0.05 ms` pre-execution JSON Schema lock |
| **Indirect Prompt Injection & Trojan-Source Defense** | `SARA` Finite-State Taint Sieve (`OWASP AISVS C02-01`) | `0.33 ms P50` (`100.0%` recall / `0.0%` FPR on 24 vectors) |
| **Zero Session Confusion & Zero Network Egress** | Local in-memory `JSON-RPC 2.0` over `stdio` (`AXIOM-1`) | `0` bytes external network calls |
| **Filesystem Path-Traversal Prevention (`%252e%252e`)** | Deterministic recursive URL-decoding & workspace jail | Blocks `../` and double-encoded traversal pre-execution |
| **Tamper-Evident Forensic Audit Trail** | `TraceKit` SHA-256 hash-chained SQLite WAL ledger (`tracekit.db`) | Cryptographic Merkle Root attestation |