How to meet it
OWASP AISVS v1.01
Model Context Protocol (MCP) Security · Component Integrity
Allow-list MCP servers
Verify that only allow-listed MCP servers are permitted.
OWASP AISVS v1.01, requirement 10.1.2
In plain English
Allow only MCP servers on an approved list.
What good looks like
- Clients connect only to listed servers.
- Adding a server needs review.
- Unlisted connections are blocked.
How teams usually do it
- Client configuration managed centrally, with an allow-list.
Evidence an auditor would accept
- The allow-list and client configuration.
Common mistakes
- Letting each developer add any server to their client.
Not sure which requirements apply to your system? Take the assessment.
Requirement text from the OWASP AI Security Verification Standard, licensed under CC BY-SA 4.0. This guidance is shared under the same licence.