Model Context Protocol (MCP) Security · Schema, Message, and Input Validation
Don't collect secrets through elicitation
Verify that MCP servers do not use form-mode elicitation to request secrets or payment credentials, and that in URL-mode elicitation the user completing the flow is the same user who initiated it.
OWASP AISVS v1.01, requirement 10.4.18
In plain English
Elicitation lets an MCP server ask the user for input through the client. In form mode, the answers pass through the client and may be visible to the model, so never use it for passwords, API keys or card details. For those, use URL mode, and make sure the person who completes the flow is the same person who started it.
What good looks like
- Form-mode elicitation never asks for secrets or payment credentials.
- Sensitive input is collected in URL mode, on a page the server controls.
- The URL flow checks that the user completing it is the user who initiated it.
- A test covers a second user trying to complete the first user's flow.
How teams usually do it
- Bind the URL flow to the initiating user's authenticated session, and check that binding on the completion page before accepting input.
- Review elicitation schemas for field names that suggest secrets.
- Clients that warn about or block form fields asking for credentials.
Suggested evidence
- The flow design.
- Tests with a mismatched user.
- A list of form-mode elicitations and the fields they request.
Common mistakes
- Asking for an API key in a form field.
- A URL flow that anyone holding the link can complete, which lets an attacker attach their own account or capture the victim's.
Not sure which requirements apply to your system? Take the assessment, or browse every guide in this chapter.
Requirement text from the OWASP AI Security Verification Standard, licensed under CC BY-SA 4.0. This guidance is shared under the same licence.