Implementation guide
OWASP AISVS v1.01
Model Context Protocol (MCP) Security · Schema, Message, and Input Validation
Screen MCP responses for prompt injection
Verify that MCP tools/list and tools/call responses are screened for indirect prompt injection before being injected into the model context.
OWASP AISVS v1.01, requirement 10.4.2
In plain English
Screen tool descriptions and tool results for hidden instructions before the model sees them. A malicious or compromised server can plant instructions in either. Hiding them in a tool description is known as tool poisoning, and it works even if the tool is never called.
What good looks like
- Tool names, descriptions and parameter descriptions from tools/list are run through injection detection.
- Results from tools/call are screened as well.
- Flagged content is blocked and logged.
- Tool descriptions are shown to the person approving a server, in full.
How teams usually do it
- The same injection classifier used for other untrusted input (see 2.1.3), applied in the MCP client or gateway.
- An MCP scanning tool run against servers before approval, for example mcp-scan.
- Normalisation and invisible-character stripping before screening (2.1.1).
Suggested evidence
- Screening configuration.
- Tests with poisoned tool descriptions and poisoned results.
- Block logs.
Common mistakes
- Screening tool results and trusting tool descriptions.
- Screening once at install, when definitions can change later (see 10.4.8).
- Ignoring the other text a server supplies, such as parameter descriptions, error messages and prompts.
Not sure which requirements apply to your system? Take the assessment, or browse every guide in this chapter.
Requirement text from the OWASP AI Security Verification Standard, licensed under CC BY-SA 4.0. This guidance is shared under the same licence.