Implementation guide
OWASP AISVS v1.01
Model Context Protocol (MCP) Security · Schema, Message, and Input Validation
Ask before opening elicitation URLs
Verify that MCP clients require explicit user consent and display the full URL before opening any URL-mode elicitation target, and do not pre-fetch the URL or its metadata.
OWASP AISVS v1.01, requirement 10.4.20
In plain English
Before an MCP client opens an elicitation URL, it should show the user the full address and ask. It should not fetch the page or its metadata in advance. A fetch is a request to a server-chosen address before the user has agreed to anything.
What good looks like
- The full URL is displayed, with the domain easy to read.
- The user must agree before anything is opened.
- The client makes no request to the URL beforehand: no pre-fetch, link preview or favicon lookup.
- Look-alike and non-ASCII domains are shown in a way that exposes them.
How teams usually do it
- A consent dialogue in the client that shows the complete URL and highlights the domain.
- Internationalised domain names shown in punycode, or flagged.
- Link-preview features switched off for elicitation targets.
Suggested evidence
- Screenshots of the dialogue.
- Network traces showing no request before consent.
Common mistakes
- Generating a link preview.
- Showing a shortened or truncated URL.
- Remembering consent for a domain and opening later URLs silently.
Not sure which requirements apply to your system? Take the assessment, or browse every guide in this chapter.
Requirement text from the OWASP AI Security Verification Standard, licensed under CC BY-SA 4.0. This guidance is shared under the same licence.