Implementation guide
OWASP AISVS v1.01
Model Context Protocol (MCP) Security · Component Integrity
Allow-list MCP servers
Verify that only allow-listed MCP servers are permitted.
OWASP AISVS v1.01, requirement 10.1.2
In plain English
Let MCP clients connect only to servers on an approved list. Every extra server is another party that can feed text into your model and receive your data, so adding one should be a deliberate decision.
What good looks like
- Clients connect only to servers on the allow-list.
- Adding a server needs a review by someone other than the requester.
- Connections to unlisted servers are blocked by configuration or network controls.
- The list is reviewed, and unused servers are removed.
How teams usually do it
- Centrally managed client configuration. Several MCP clients and coding assistants support organisation-level allow-lists or managed settings.
- An MCP gateway that all clients connect through, exposing only approved servers.
- Egress rules that block direct connections to unapproved remote MCP endpoints.
Suggested evidence
- The allow-list and the review record for a recent addition.
- Managed client configuration.
- A test showing an unlisted server is refused.
Common mistakes
- Letting each developer add any server to their own client.
- Approving a server by name and not by address and version.
- Project-level configuration files that add servers automatically when a repository is opened.
Not sure which requirements apply to your system? Take the assessment, or browse every guide in this chapter.
Requirement text from the OWASP AI Security Verification Standard, licensed under CC BY-SA 4.0. This guidance is shared under the same licence.