Implementation guide
OWASP AISVS v1.01
Model Context Protocol (MCP) Security · Schema, Message, and Input Validation
Mark user-specific results as private
Verify that MCP servers mark cacheable results containing user-specific or authorization-filtered data with a private cache scope.
OWASP AISVS v1.01, requirement 10.4.17
In plain English
An MCP server knows which of its results are specific to one user. It should mark cacheable results that contain user-specific or permission-filtered data as private, so clients and intermediaries do not share them with anyone else.
What good looks like
- Results containing user data, or filtered by the caller's permissions, are marked with a private cache scope.
- Only results that are the same for every caller are marked shareable.
- The default for a new tool is private or not cacheable.
- The marking is tested.
How teams usually do it
- Set the cache scope in the server's response code, per tool.
- A review step for any tool whose result is marked shareable.
Suggested evidence
- Response samples showing the cache scope.
- Tests for tools that return user-specific data.
Common mistakes
- Making everything shareable by default.
- Marking a result shareable because it contains no personal data, when the caller's permissions still filtered it.
Not sure which requirements apply to your system? Take the assessment, or browse every guide in this chapter.
Requirement text from the OWASP AI Security Verification Standard, licensed under CC BY-SA 4.0. This guidance is shared under the same licence.