Model Context Protocol (MCP) Security · Schema, Message, and Input Validation
Limit schema validation depth
Verify that MCP implementations apply resource bounds to schema validation, such as a maximum schema depth, a cap on the total number of nested schema elements, or a per-validation time budget.
OWASP AISVS v1.01, requirement 10.4.13
In plain English
Schema validation is itself work that an attacker can make expensive. A deeply nested or self-referencing schema from a remote server can tie up a validator for a long time. Put limits on the validation: maximum depth, total number of elements, or a time budget.
What good looks like
- Schemas have a maximum nesting depth and a cap on total elements.
- Each validation has a time budget.
- Schemas or documents over the limits are rejected.
- Limits apply to schemas received from servers and to data validated against them.
How teams usually do it
- The depth and size options in your validation library, plus a wrapper that enforces a timeout.
- A size limit on the schema document before it is parsed.
- Avoiding regular expressions from untrusted schemas, or running them in an engine with guaranteed linear time such as RE2.
Suggested evidence
- Configuration.
- Tests with deeply nested and recursive schemas.
Common mistakes
- Unlimited validation of schemas supplied by remote servers.
- A pattern taken from an untrusted schema and run in a backtracking regex engine.
Not sure which requirements apply to your system? Take the assessment, or browse every guide in this chapter.
Requirement text from the OWASP AI Security Verification Standard, licensed under CC BY-SA 4.0. This guidance is shared under the same licence.