How to meet it
OWASP AISVS v1.01
Model Context Protocol (MCP) Security · Secure Transport
Use stdio only locally
Verify that stdio transport is permitted only in controlled local environments.
OWASP AISVS v1.01, requirement 10.3.2
In plain English
Use the stdio transport only for local servers in environments you control.
What good looks like
- stdio servers run only on the user's own machine or a controlled host.
- Remote connections use HTTP transport.
- Local servers are sandboxed.
How teams usually do it
- Client policies that allow stdio only for approved local servers.
Evidence an auditor would accept
- Client configuration.
Common mistakes
- Tunnelling stdio to a remote host to save time.
Not sure which requirements apply to your system? Take the assessment.
Requirement text from the OWASP AI Security Verification Standard, licensed under CC BY-SA 4.0. This guidance is shared under the same licence.