Implementation guide
OWASP AISVS v1.01
Model Context Protocol (MCP) Security · Schema, Message, and Input Validation
Sign MCP tool responses
Verify that MCP servers sign tool responses with a unique nonce and timestamp so MCP clients can detect replay attempts.
OWASP AISVS v1.01, requirement 10.4.6
In plain English
Have MCP servers sign each tool response, with a unique nonce and a timestamp inside the signed data. The client can then tell that a response is genuine and fresh, and can spot one that has been captured and replayed.
What good looks like
- Each tool response carries a signature covering the content, a unique nonce and a timestamp.
- Clients verify the signature and reject responses with a reused nonce or a stale timestamp.
- The accepted clock difference is small.
- Signing keys are managed and can be rotated.
How teams usually do it
- Server-side signing with a key whose public half the client obtains through a trusted route.
- A short-lived nonce cache in the client, sized to the timestamp window.
- A standard signature format such as JWS or HTTP Message Signatures (RFC 9421) in place of a home-made one.
Suggested evidence
- The response format.
- Replay tests showing rejection.
- Key management records.
Common mistakes
- Signing responses that clients never check.
- A timestamp with no nonce, which permits replay inside the time window.
- Leaving the nonce or timestamp outside the signed content.
Not sure which requirements apply to your system? Take the assessment, or browse every guide in this chapter.
Requirement text from the OWASP AI Security Verification Standard, licensed under CC BY-SA 4.0. This guidance is shared under the same licence.