Implementation guide
OWASP AISVS v1.01
Model Context Protocol (MCP) Security · Authentication & Authorization
Authorise every MCP tool call
Verify that MCP servers enforce access control on every tool invocation, validating that the user's access token authorizes both the requested tool and the specific argument values supplied.
OWASP AISVS v1.01, requirement 10.2.5
In plain English
On every tool call, check that the user's token allows both the tool and the specific argument values. Being allowed to call "read file" does not mean being allowed to read every file.
What good looks like
- Each call is checked for permission to use the tool and for permission on the argument values supplied.
- Disallowed values are rejected before any work is done.
- The check uses the user's token, and the server's own access rights are not a substitute.
- Rejections are logged.
How teams usually do it
- An authorisation check at the top of every tool handler, or in shared middleware, that looks at arguments such as resource IDs, paths, tenant IDs and amounts.
- A policy engine (for example Open Policy Agent or Cedar) for anything beyond simple rules.
- Tests for each tool with arguments that point at another user's resources.
Suggested evidence
- Tests with allowed tools and disallowed arguments.
- Handler code or policy definitions.
- Rejection logs.
Common mistakes
- Checking the tool name and accepting any arguments.
- A server that reaches the backend with one powerful service account and never compares the request with the user's rights.
Not sure which requirements apply to your system? Take the assessment, or browse every guide in this chapter.
Requirement text from the OWASP AI Security Verification Standard, licensed under CC BY-SA 4.0. This guidance is shared under the same licence.