Implementation guide
OWASP AISVS v1.01
Model Context Protocol (MCP) Security · Schema, Message, and Input Validation
Keep personal data out of elicitation URLs
Verify that MCP servers exclude end-user credentials and personal data from URL-mode elicitation URLs, and do not issue URLs that are pre-authenticated to a protected resource.
OWASP AISVS v1.01, requirement 10.4.19
In plain English
URLs get logged, cached, shared and stored in browser history. Keep credentials and personal data out of elicitation URLs, and never issue a URL that is already authenticated to a protected resource.
What good looks like
- Elicitation URLs contain no credentials, tokens or personal data.
- Opening the URL requires the user to sign in as normal.
- Any identifier in the URL is opaque and short-lived.
- URL construction is covered in code review.
How teams usually do it
- An opaque, single-use reference in the URL that points to state held on the server.
- Normal authentication on the landing page, checked against the user who started the flow (see 10.4.18).
Suggested evidence
- Sample URLs.
- The code that builds them.
- A test showing the URL does not work without signing in.
Common mistakes
- Pre-authenticated "magic" links that work for anyone who obtains them.
- Putting the user's email address or account number in the query string.
Not sure which requirements apply to your system? Take the assessment, or browse every guide in this chapter.
Requirement text from the OWASP AI Security Verification Standard, licensed under CC BY-SA 4.0. This guidance is shared under the same licence.