Implementation guide
OWASP AISVS v1.01
Model Context Protocol (MCP) Security · Schema, Message, and Input Validation
Open elicitation pages out of the model's sight
Verify that MCP clients open URL-mode elicitation targets so that neither the client nor the model can observe the page contents or the user's input.
OWASP AISVS v1.01, requirement 10.4.21
In plain English
The purpose of URL-mode elicitation is to let the user enter sensitive information somewhere the client and the model cannot see it. Open the page in a way that keeps that true.
What good looks like
- Elicitation targets open in the system browser or a properly isolated secure view.
- The client cannot read the page's content or what the user types.
- The model receives only the outcome, such as "completed" or "cancelled".
- Nothing from the page is written into the conversation or the logs.
How teams usually do it
- Open the URL in the user's default browser, or use the platform's secure browser session (for example ASWebAuthenticationSession on Apple platforms or Custom Tabs on Android).
- Avoid embedded web views that the host application can script or inspect.
Suggested evidence
- The client design.
- A test or code review showing the client has no access to page content.
Common mistakes
- Rendering the page in an embedded view the client can read.
- Having a browser-automation tool open the page, which puts the content straight into the model's context.
Not sure which requirements apply to your system? Take the assessment, or browse every guide in this chapter.
Requirement text from the OWASP AI Security Verification Standard, licensed under CC BY-SA 4.0. This guidance is shared under the same licence.