Implementation guide
OWASP AISVS v1.01
Model Context Protocol (MCP) Security · Component Integrity
Get MCP components from trusted sources
Verify that MCP components are obtained only from trusted sources and cryptographically verified.
OWASP AISVS v1.01, requirement 10.1.1
In plain English
An MCP server is code that runs with your data and often your credentials. Get MCP servers and other MCP components only from sources you trust, and verify each download is what the publisher released. Fake and trojaned MCP packages have already turned up in public registries.
What good looks like
- MCP components come from a written list of approved publishers or an internal registry.
- A signature or hash is checked before installation.
- Versions are pinned to an exact release or digest. Nothing installs "latest".
- Updates go through the same checks as the first install.
How teams usually do it
- An internal registry or mirror of approved MCP servers, each pinned by version and hash.
- Verifying package provenance where the ecosystem supports it, for example npm provenance attestations, PyPI attestations or signed container images.
- A code review or automated scan of each server before it is approved, covering its tool descriptions as well as its code.
Suggested evidence
- The approved list, with versions and hashes.
- Verification records from installation.
- Client configuration showing pinned versions.
Common mistakes
- Installing a server with a one-line npx or uvx command copied from a README or forum post, which fetches whatever is newest at that moment.
- Trusting a package because its name resembles a well-known vendor's.
- Pinning the server and letting its own dependencies float.
Not sure which requirements apply to your system? Take the assessment, or browse every guide in this chapter.
Requirement text from the OWASP AI Security Verification Standard, licensed under CC BY-SA 4.0. This guidance is shared under the same licence.