Implementation guide
OWASP AISVS v1.01
Model Context Protocol (MCP) Security · Authentication & Authorization
List only the tools a user may use
Verify that MCP tools/list returns only tools permitted by the requester's authorized scopes, and that list responses vary only by authorization context, never by connection.
OWASP AISVS v1.01, requirement 10.2.4
In plain English
The list of tools a server returns should depend only on what the caller is authorised to use. Two connections with the same authorisation should see the same list, and a caller should never be shown tools they cannot call.
What good looks like
- The response to tools/list is filtered by the scopes on the caller's token.
- The same authorisation always produces the same list, whatever the connection, session or client.
- Callers with fewer scopes see fewer tools, and this is tested.
- Filtering the list is in addition to checking each call (see 10.2.5).
How teams usually do it
- Tag each tool with the scope it needs and filter the registry at request time.
- Derive the list from the token on each request, with no state kept from earlier requests on the connection.
- Tests that compare lists across connections with identical tokens.
Suggested evidence
- Tests with different scopes.
- The tool-to-scope mapping.
Common mistakes
- Returning every tool and relying on later checks. Tool descriptions enter the model's context and can leak information or carry instructions.
- Lists that vary by connection, which lets a server show one thing at approval time and another later.
Not sure which requirements apply to your system? Take the assessment, or browse every guide in this chapter.
Requirement text from the OWASP AI Security Verification Standard, licensed under CC BY-SA 4.0. This guidance is shared under the same licence.