Implementation guide
OWASP AISVS v1.01
Model Context Protocol (MCP) Security · Schema, Message, and Input Validation
Strict schema validation on MCP servers
Verify that all MCP servers enforce strict schema validation.
OWASP AISVS v1.01, requirement 10.4.4
In plain English
Every MCP server should validate every incoming request against a strict schema before doing anything with it. The arguments in a tool call were written by a language model that may be following an attacker's instructions, so treat them like any other untrusted input.
What good looks like
- Every tool has a strict input schema: types, formats, ranges, allowed values and no extra fields.
- Validation runs before any processing or side effect.
- Requests that fail are rejected with an error.
- No tool is exempt.
How teams usually do it
- Schema validation middleware in the server framework, with schemas generated from typed definitions (for example Pydantic or Zod models).
- A CI check that fails if a tool is registered without a strict schema.
- Ordinary injection defences behind the schema: parameterised queries, no shell string-building, path canonicalisation.
Suggested evidence
- Server configuration and tool schemas.
- The CI check.
- Tests with invalid input for each tool.
Common mistakes
- Validating some tools and leaving others loose.
- Schemas where every field is an unconstrained string.
- Treating schema validation as a replacement for safe handling of the values afterwards.
Not sure which requirements apply to your system? Take the assessment, or browse every guide in this chapter.
Requirement text from the OWASP AI Security Verification Standard, licensed under CC BY-SA 4.0. This guidance is shared under the same licence.