Implementation guide
OWASP AISVS v1.01
Model Context Protocol (MCP) Security · Schema, Message, and Input Validation
Ask before installing a local MCP server
Verify that MCP clients present users with explicit consent dialogue and cancellation options upon installation of a local MCP server.
OWASP AISVS v1.01, requirement 10.4.7
In plain English
Installing a local MCP server means running someone's code on the user's machine. Before that happens, the client should show clearly what is about to be installed and run, ask the user to agree, and let them cancel.
What good looks like
- The install prompt shows the server's name, source and the exact command that will run.
- The user must confirm explicitly. Nothing installs by default.
- Cancelling leaves nothing installed or running.
- The dialogue cannot be pre-approved or skipped by a link or a configuration file from an untrusted source.
How teams usually do it
- A consent dialogue in the client's install flow that displays the full launch command and arguments.
- The same prompt for servers added through deep links, project files and extensions.
- Organisation policy on top that limits what can be offered at all (see 10.1.2).
Suggested evidence
- Screenshots of the dialogue.
- A test showing cancel leaves no trace.
Common mistakes
- Installing in the background when a link is clicked.
- Truncating the command in the dialogue, so the dangerous part is off screen.
- Auto-starting servers defined in a repository as soon as it is opened.
Not sure which requirements apply to your system? Take the assessment, or browse every guide in this chapter.
Requirement text from the OWASP AI Security Verification Standard, licensed under CC BY-SA 4.0. This guidance is shared under the same licence.