Skip to content
T threat.cafe

Category

Regulation and frameworks

2 posts

  1. · Constance Ibe-Whitmore · Regulation and frameworks · on threat.cafe

    OWASP's two agent Top 10s, ASI and AST, mapped to controls you can actually test

    OWASP's Agentic Applications list (ASI) and its incubating Agentic Skills list (AST) overlap on supply chain, drift and privilege. This crosswalk pairs each AST item with ASI risks, a test, and an honest tooling status.

  2. · Constance Ibe-Whitmore · Regulation and frameworks · on threat.cafe

    The MCP spec's own security MUSTs, read by a buyer: five requirements to make any MCP vendor prove

    The MCP spec already sets security obligations: no token passthrough, per-client consent, verified requests, exact-command consent, safe URL handling. Ask vendors to prove each, in the spec's own words.