howtosecure.ai

← Back to your requirements

How to meet it OWASP AISVS v1.01

Model Context Protocol (MCP) Security · Secure Transport

Encrypted, authenticated transport for remote MCP

AISVS 10.3.1 Level 1

Verify that authenticated, encrypted streamable HTTP is used for MCP transport for remote services.

OWASP AISVS v1.01, requirement 10.3.1

In plain English

Use authenticated, encrypted streamable HTTP for remote MCP connections.

What good looks like

  • Remote MCP uses HTTPS with current TLS.
  • Clients authenticate.
  • Plain HTTP is refused.

How teams usually do it

  • Standard TLS termination and OAuth on the MCP endpoint.

Evidence an auditor would accept

  • Endpoint configuration and a TLS scan.

Common mistakes

  • Allowing plain HTTP on internal networks.

Related requirements

10.3.5 Sender-constrained MCP tokens · 10.2.1 Check the token on every MCP request

Not sure which requirements apply to your system? Take the assessment.

Requirement text from the OWASP AI Security Verification Standard, licensed under CC BY-SA 4.0. This guidance is shared under the same licence.