Model Context Protocol (MCP) Security · Schema, Message, and Input Validation
Don't fetch remote schema references
Verify that MCP implementations do not automatically dereference JSON Schema `$ref` values that resolve to network URIs, and that any opt-in external resolution is disabled by default and rejects loopback, link-local, and private network addresses.
OWASP AISVS v1.01, requirement 10.4.14
In plain English
JSON Schema lets one schema refer to another by URL using $ref. If your validator fetches those URLs automatically, a malicious schema can make your system send requests to internal addresses. This is server-side request forgery. Do not follow network references by default.
What good looks like
- $ref values that resolve to network addresses are not fetched by default.
- Any external resolution is an explicit opt-in.
- When enabled, it refuses loopback, link-local and private network addresses, including after DNS resolution and redirects.
- The behaviour is tested.
How teams usually do it
- Switch off remote reference loading in the schema library. Check the default, because some libraries fetch.
- Resolve references only within the same document or from a local, pre-approved set.
- If you must fetch, go through an egress proxy with an allow-list.
Suggested evidence
- Library configuration.
- Tests with references to internal addresses such as the cloud metadata service, showing no request is made.
Common mistakes
- Library defaults that fetch any URL found in a schema.
- Blocking by hostname string and missing addresses reached through DNS or a redirect.
Not sure which requirements apply to your system? Take the assessment, or browse every guide in this chapter.
Requirement text from the OWASP AI Security Verification Standard, licensed under CC BY-SA 4.0. This guidance is shared under the same licence.