Model Context Protocol (MCP) Security · Secure Transport
Check protocol version before trusting headers
Verify that MCP intermediaries enforcing policy on mirrored request headers confirm that the protocol version indicates a revision requiring header and body validation before trusting those headers.
OWASP AISVS v1.01, requirement 10.3.6
In plain English
Newer MCP revisions copy some request details into HTTP headers so that gateways and proxies can apply policy without parsing the body. Those headers can be trusted only when the protocol version in use requires the server to check them against the body. An intermediary must confirm that version first. Otherwise a client can claim one thing in the header and send another in the body.
What good looks like
- The intermediary reads the negotiated protocol version before relying on mirrored headers.
- For versions that do not require header and body to be validated together, it does not use those headers for policy. It inspects the body or applies a stricter default.
- Requests with a missing or unrecognised version are treated as untrusted.
- Tests cover both kinds of version.
How teams usually do it
- Version-aware rules in the gateway or proxy.
- Body inspection as the fallback for older versions.
- A minimum protocol version enforced at the gateway (see 10.3.4), which removes the older case.
Suggested evidence
- Gateway rules.
- Tests with an old-version request carrying misleading headers.
Common mistakes
- Trusting mirrored headers from any client regardless of version.
- Assuming the server behind the gateway will catch a mismatch when it is running an older revision that does not check.
Not sure which requirements apply to your system? Take the assessment, or browse every guide in this chapter.
Requirement text from the OWASP AI Security Verification Standard, licensed under CC BY-SA 4.0. This guidance is shared under the same licence.