Model Context Protocol (MCP) Security · Schema, Message, and Input Validation
Keep private cached responses private
Verify that MCP clients and intermediaries reuse cached responses marked with a private cache scope only within the authorization context that produced them, and do not cache results of multi round-trip requests.
OWASP AISVS v1.01, requirement 10.4.16
In plain English
A cached response marked private belongs to the authorisation context that produced it. Clients and intermediaries may reuse it only in that same context. Results of requests that took several round trips should not be cached at all, because they depend on an exchange a cache key cannot capture.
What good looks like
- Private cache entries are keyed by the authorisation context (user, token subject and scopes) as well as the request.
- A cached private response is never served to a different user or context.
- Results of multi round-trip requests are not cached.
- Tests confirm one user cannot receive another's cached result.
How teams usually do it
- Cache keys that include the user or token identity and scopes.
- Shared intermediaries configured not to store private responses at all.
- Clearing a user's entries when their token or permissions change.
Suggested evidence
- Cache configuration and key design.
- Cross-user cache tests.
Common mistakes
- Caching by tool name and arguments only.
- A shared gateway cache that ignores the private marking.
- Keeping entries after the user's permissions have been reduced.
Not sure which requirements apply to your system? Take the assessment, or browse every guide in this chapter.
Requirement text from the OWASP AI Security Verification Standard, licensed under CC BY-SA 4.0. This guidance is shared under the same licence.