Implementation guide
OWASP AISVS v1.01
Model Context Protocol (MCP) Security · Authentication & Authorization
Use one-time request state only once
Verify that MCP servers enforce single use server-side for `requestState` that must be consumed at most once.
OWASP AISVS v1.01, requirement 10.2.10
In plain English
Where a piece of request state is meant to be used once, the server has to enforce that itself. A client, or an attacker who captured the state, may send it again.
What good looks like
- The server tracks single-use state and marks it consumed on first use.
- A second use is rejected.
- Consumption is atomic, so two simultaneous requests cannot both succeed.
- Tracking survives restarts and works across server instances, for as long as the state is valid.
How teams usually do it
- A server-side store of state identifiers (for example Redis or a database) with an atomic "use if unused" operation and an expiry matching the state's lifetime.
- Short lifetimes, so the store stays small.
Suggested evidence
- Tests with replayed state, including two concurrent uses.
- Store configuration and expiry settings.
Common mistakes
- Relying on the client to discard state.
- An in-memory list on one instance behind a load balancer, so a replay sent to another instance succeeds.
- A check-then-mark sequence that is not atomic.
Not sure which requirements apply to your system? Take the assessment, or browse every guide in this chapter.
Requirement text from the OWASP AI Security Verification Standard, licensed under CC BY-SA 4.0. This guidance is shared under the same licence.