Implementation guide
OWASP AISVS v1.01
Model Context Protocol (MCP) Security · Secure Transport
Encrypted, authenticated transport for remote MCP
Verify that authenticated, encrypted streamable HTTP is used for MCP transport for remote services.
OWASP AISVS v1.01, requirement 10.3.1
In plain English
Remote MCP connections should use the streamable HTTP transport over TLS, with the client authenticated. Anything less exposes prompts, tool results and tokens to whoever sits on the network path.
What good looks like
- Remote MCP endpoints are served over HTTPS only, with TLS 1.2 or later and TLS 1.3 preferred.
- Clients authenticate, normally with OAuth as the MCP specification describes.
- Plain HTTP is refused outright.
- Clients validate the server's certificate.
How teams usually do it
- Standard TLS termination at a load balancer or gateway, with OAuth validation on the MCP endpoint.
- Moving off the older HTTP+SSE transport, which the specification has deprecated in favour of streamable HTTP.
- HSTS and a periodic TLS configuration scan.
Suggested evidence
- Endpoint configuration.
- A TLS scan report.
- A test showing plain HTTP and unauthenticated requests are refused.
Common mistakes
- Allowing plain HTTP on internal networks.
- Clients configured to skip certificate checks to get past a development problem.
- Remote endpoints left on a legacy transport with no authentication.
Not sure which requirements apply to your system? Take the assessment, or browse every guide in this chapter.
Requirement text from the OWASP AI Security Verification Standard, licensed under CC BY-SA 4.0. This guidance is shared under the same licence.