howtosecure.ai
Implementation guide OWASP AISVS v1.01

Model Context Protocol (MCP) Security · Schema, Message, and Input Validation

Reject schemas with unresolved references

AISVS 10.4.15 Level 2

Verify that MCP implementations reject schemas that fail to validate due to an unresolved external `$ref` rather than treating them as permissive.

OWASP AISVS v1.01, requirement 10.4.15

In plain English

If a schema cannot be fully checked because an external reference did not resolve, reject it. Some validators treat an unresolved reference as "anything is valid", which turns your validation off without telling you.

What good looks like

  • An unresolved $ref causes validation to fail.
  • The failure is logged with the reference that could not be resolved.
  • The affected tool or message is not used.
  • Tests cover unresolved references.

How teams usually do it

  • Strict mode in the validation library, and a test that proves it behaves as expected.
  • Compiling and checking schemas when a tool is registered, so problems surface before the first call.

Suggested evidence

  • Tests showing a schema with an unresolvable reference is rejected.
  • Library configuration.

Common mistakes

  • Libraries that treat unknown references as an empty, permissive schema.
  • Catching the resolver's exception and carrying on without validation.

Related requirements

10.4.14 Don't fetch remote schema references

Not sure which requirements apply to your system? Take the assessment, or browse every guide in this chapter.

Requirement text from the OWASP AI Security Verification Standard, licensed under CC BY-SA 4.0. This guidance is shared under the same licence.