Implementation guide
OWASP AISVS v1.01
Model Context Protocol (MCP) Security · Schema, Message, and Input Validation
Validate MCP responses against their schema
Verify that MCP tools/list and tools/call responses are validated against their declared schemas before being injected into the model context.
OWASP AISVS v1.01, requirement 10.4.1
In plain English
Check what an MCP server sends back, both its tool list and its tool results, against the declared schemas before any of it goes into the model's context. A server you connect to is a third party, and its responses are untrusted input.
What good looks like
- tools/list responses are validated against the protocol schema before the tools are registered.
- tools/call results are validated against the tool's declared output schema where there is one.
- Invalid responses are rejected and do not reach the model.
- Rejections are logged.
How teams usually do it
- Schema validation in the MCP client or gateway, using the SDK's built-in validation and a JSON Schema validator for output schemas.
- Size and length limits on descriptions and results.
- Requiring structured output with an output schema for the tools you depend on.
Suggested evidence
- Client code or gateway configuration.
- Tests with malformed and oversized responses.
Common mistakes
- Passing raw server responses into the prompt.
- Validating results and not tool definitions.
- Accepting extra, undeclared fields and passing them to the model.
Not sure which requirements apply to your system? Take the assessment, or browse every guide in this chapter.
Requirement text from the OWASP AI Security Verification Standard, licensed under CC BY-SA 4.0. This guidance is shared under the same licence.