Implementation guide
OWASP AISVS v1.01
Model Context Protocol (MCP) Security · Secure Transport
Use stdio only locally
Verify that stdio transport is permitted only in controlled local environments.
OWASP AISVS v1.01, requirement 10.3.2
In plain English
The stdio transport runs an MCP server as a local process and talks to it over standard input and output. It has no authentication and no encryption because it assumes both ends are on one trusted machine. Use it only there.
What good looks like
- stdio servers run only on the user's own machine or a controlled host.
- Anything remote uses the HTTP transport with TLS and authentication.
- Clients allow stdio only for approved local servers.
- Local stdio servers are sandboxed (see 10.1.3).
How teams usually do it
- Client policy or managed configuration listing the approved local servers and their exact launch commands.
- Review of launch commands, since a stdio server entry is in effect a command the client will run.
Suggested evidence
- Client configuration showing which servers use stdio.
- The policy for remote connections.
Common mistakes
- Tunnelling stdio to a remote host over SSH or a socket to save setting up HTTP.
- Wrapping a remote server in a local stdio shim that holds a long-lived credential.
- Accepting stdio launch commands from a repository's project file without review.
Not sure which requirements apply to your system? Take the assessment, or browse every guide in this chapter.
Requirement text from the OWASP AI Security Verification Standard, licensed under CC BY-SA 4.0. This guidance is shared under the same licence.