Implementation guide
OWASP AISVS v1.01
Model Context Protocol (MCP) Security · Authentication & Authorization
MCP servers don't store tokens
Verify that MCP servers acting as OAuth 2.1 resource servers do not store or persist access tokens or user credentials.
OWASP AISVS v1.01, requirement 10.2.3
In plain English
An MCP server acting as an OAuth resource server should use each access token for the request in hand and then let it go. It should not save tokens or user credentials. A server that stores them becomes a target worth breaking into.
What good looks like
- Access tokens are held in memory for the life of the request and are not written to disk or a database.
- Logs, traces and error reports contain no tokens.
- The server keeps no store of user passwords or credentials.
- Any token the server needs for a downstream service is obtained and managed separately (see 10.2.7).
How teams usually do it
- Redaction of the Authorization header and token-like strings in logging and tracing middleware.
- A code review and a search of storage for token persistence.
- A token vault or the platform's secret store for any downstream credentials. They are never kept in the MCP server's own database.
Suggested evidence
- Log samples showing redaction.
- A storage and code review confirming no token persistence.
Common mistakes
- Logging full request headers.
- Caching tokens in a session store "for performance".
- Crash dumps or debug traces that capture the token.
Not sure which requirements apply to your system? Take the assessment, or browse every guide in this chapter.
Requirement text from the OWASP AI Security Verification Standard, licensed under CC BY-SA 4.0. This guidance is shared under the same licence.