How to meet it
OWASP AISVS v1.01
Model Context Protocol (MCP) Security · Component Integrity
Get MCP components from trusted sources
Verify that MCP components are obtained only from trusted sources and cryptographically verified.
OWASP AISVS v1.01, requirement 10.1.1
In plain English
Get MCP servers and components only from sources you trust, and verify they are what the publisher released.
What good looks like
- MCP components come from approved publishers.
- Signatures or hashes are checked before installation.
- Versions are pinned.
How teams usually do it
- An internal registry of approved MCP servers with pinned, verified versions.
Evidence an auditor would accept
- The approved list and verification records.
Common mistakes
- Installing MCP servers with a one-line command copied from a forum.
Not sure which requirements apply to your system? Take the assessment.
Requirement text from the OWASP AI Security Verification Standard, licensed under CC BY-SA 4.0. This guidance is shared under the same licence.