OWASP LLM Top 10 (2025)

Sievant and the OWASP LLM Top 10

The mapping sievant policy owasp prints, rendered here.

This maps Sievant's controls to the OWASP Top 10 for LLM Applications categories they address. It is not a compliance certification, an audit or an assessment of any system, and it does not mean a category's risk is fully mitigated: each control addresses part of a category, within what an MCP gateway can see.

Controls per OWASP category
Category	Sievant controls
LLM01:2025 Prompt Injection	Prompt-injection detection on arguments and results (flag, annotate, block) Tool definitions read once, pinned, and pinned on first use Upstream resources and prompts not served unchecked
LLM02:2025 Sensitive Information Disclosure	Path and URL argument rules for every tool Credentials and personal data in tool arguments blocked or redacted Credentials and personal data redacted from tool results Upstream resources and prompts not served unchecked Client configuration audit (sievant scan)
LLM03:2025 Supply Chain	Tool definitions read once, pinned, and pinned on first use Client configuration audit (sievant scan)
LLM04:2025 Data and Model Poisoning	Not addressed. Training and fine-tuning data are outside an MCP gateway's view.
LLM05:2025 Improper Output Handling	Schema validation and argument constraints (min, max, in, matches, path_under, url_hosts)
LLM06:2025 Excessive Agency	Deny-by-default policies for tools, prompts and resources, per agent Schema validation and argument constraints (min, max, in, matches, path_under, url_hosts) Path and URL argument rules for every tool SSRF guard on outbound connectors Client configuration audit (sievant scan)
LLM07:2025 System Prompt Leakage	Not addressed. System prompts stay between the client and the model; Sievant does not see them.
LLM08:2025 Vector and Embedding Weaknesses	Not addressed. Sievant does not manage vector stores or embeddings (a retrieval tool behind it is subject to its other controls).
LLM09:2025 Misinformation	Not addressed. Whether model output is true is outside what a gateway can check.
LLM10:2025 Unbounded Consumption	Rate limits per agent and per tool Row, byte and response-memory budgets

How each control helps

Control	Configuration	How
Deny-by-default policies for tools, prompts and resources, per agent	`policies`	An agent can call only the tools its policy allows, so a steered model cannot reach the rest.
Schema validation and argument constraints (min, max, in, matches, path_under, url_hosts)	`policies[].constraints`	Tool arguments are model output sent to a backend; they are validated against the tool's schema and the policy before the backend sees them.
Path and URL argument rules for every tool	`arguments`	Path arguments must stay under listed roots and URL arguments must go to listed hosts, narrowing what a steered agent can read or send out.
Credentials and personal data in tool arguments blocked or redacted	`sanitization.input_credentials, sanitization.input_pii`	Secrets and personal data the model puts into arguments do not reach the backend (or reach it redacted).
Credentials and personal data redacted from tool results	`sanitization.detectors`	Results are redacted before the model sees them, so they cannot be repeated to the user or sent elsewhere.
Prompt-injection detection on arguments and results (flag, annotate, block)	`injection`	Instruction-like text in tool results (indirect injection) and arguments is scored, recorded, and annotated or blocked.
Tool definitions read once, pinned, and pinned on first use	`connectors.mcp[].tools[].sha256, pinning`	A server cannot change a tool's description (instructions the model reads) or schema after it was reviewed without the tool being withheld.
Upstream resources and prompts not served unchecked	`connectors.mcp[].serve_resources, serve_prompts`	Upstream resources and prompts are withheld, and the withholding reported, unless the connector sets serve_resources or serve_prompts; served ones pass the output checks tool results pass (budgets, redaction, injection detection), and prompt arguments pass input sanitization.
Rate limits per agent and per tool	`rate_limit`	A runaway or steered agent cannot call tools without bound.
Row, byte and response-memory budgets	`output, server.limits`	Results are bounded in size and over time, limiting cost and context flooding.
SSRF guard on outbound connectors	`connectors.*.allow_private_networks`	Connectors cannot be pointed at private networks unless allowed.
Client configuration audit (sievant scan)	`(command)`	Finds hard-coded secrets, unpinned or remotely fetched servers, and over-broad access before they are used.
Audit trail of every call and security event	`audit`	Supports investigating every category above; it does not prevent any by itself.

Categories from OWASP Top 10 for LLM Applications, edition 2025, retrieved 2026-10-18.