Implementation guide
OWASP AISVS v1.01
Model Context Protocol (MCP) Security · Authentication & Authorization
Check the token on every MCP request
Verify that MCP servers validate access tokens for each request and do not rely on transport security alone.
OWASP AISVS v1.01, requirement 10.2.1
In plain English
An MCP server must check the access token on every request. TLS tells you the connection is private. It tells you nothing about who is on the other end or what they may do.
What good looks like
- Every request is authenticated by validating its access token.
- A request with a missing, expired or invalid token is rejected with the correct error.
- There is no unauthenticated mode in production.
- A session identifier is never treated as proof of identity.
How teams usually do it
- Token validation middleware in front of every MCP endpoint, including any legacy or streaming endpoints.
- Following the MCP authorisation specification, in which the server acts as an OAuth resource server.
- An integration test that calls each endpoint without a token.
Suggested evidence
- Server code or gateway configuration showing validation on every route.
- Test results for missing and invalid tokens.
Common mistakes
- Authenticating when the connection opens and trusting everything after that.
- Treating an internal network location as authentication.
- Using the MCP session ID as a credential.
Not sure which requirements apply to your system? Take the assessment, or browse every guide in this chapter.
Requirement text from the OWASP AI Security Verification Standard, licensed under CC BY-SA 4.0. This guidance is shared under the same licence.