How to meet it
OWASP AISVS v1.01
Model Context Protocol (MCP) Security · Authentication & Authorization
Validate MCP token claims
Verify that MCP servers validate the presented access token's issuer, audience, expiration, and scope claims in accordance with OAuth 2.1.
OWASP AISVS v1.01, requirement 10.2.2
In plain English
Check the token's issuer, audience, expiry and scopes as OAuth 2.1 requires.
What good looks like
- All four are checked on each request.
- Tokens for other audiences are rejected.
- Clock skew allowances are small.
How teams usually do it
- A maintained OAuth library configured with the expected issuer and audience.
Evidence an auditor would accept
- Validation configuration and tests with wrong audience and expired tokens.
Common mistakes
- Checking the signature but not the audience.
Not sure which requirements apply to your system? Take the assessment.
Requirement text from the OWASP AI Security Verification Standard, licensed under CC BY-SA 4.0. This guidance is shared under the same licence.