Implementation guide
OWASP AISVS v1.01
Model Context Protocol (MCP) Security · Authentication & Authorization
Validate MCP token claims
Verify that MCP servers validate the presented access token's issuer, audience, expiration, and scope claims in accordance with OAuth 2.1.
OWASP AISVS v1.01, requirement 10.2.2
In plain English
Validating a token means more than checking its signature. The server must confirm who issued it, that it was meant for this server, that it has not expired and that its scopes cover the request, as OAuth 2.1 sets out.
What good looks like
- Issuer, audience, expiry and scope are all checked on every request.
- A token issued for a different audience is rejected.
- The signing algorithm is fixed by configuration and not taken from the token.
- Clock-skew allowance is small, a minute or two at most.
How teams usually do it
- A maintained OAuth or JWT library configured with the expected issuer, audience and algorithms. Do not write your own validation.
- Signing keys fetched from the authorisation server's published key set, with caching and rotation handled by the library.
- Token introspection where tokens are opaque.
Suggested evidence
- Validation configuration.
- Tests with a wrong audience, wrong issuer, expired token and missing scope, each rejected.
Common mistakes
- Checking the signature and skipping the audience.
- Accepting whatever algorithm the token header names, including "none".
- A clock-skew allowance of hours.
Not sure which requirements apply to your system? Take the assessment, or browse every guide in this chapter.
Requirement text from the OWASP AI Security Verification Standard, licensed under CC BY-SA 4.0. This guidance is shared under the same licence.