How to meet it
OWASP AISVS v1.01
Model Context Protocol (MCP) Security · Secure Transport
No fallback to older MCP protocol versions
Verify that MCP clients enforce a minimum acceptable protocol version and do not retry with, or fall back to, a protocol version or legacy handshake below that minimum.
OWASP AISVS v1.01, requirement 10.3.4
In plain English
MCP clients should set a minimum protocol version and refuse to drop to anything older.
What good looks like
- The minimum version is configured.
- Older versions and legacy handshakes are refused.
- Downgrade attempts are logged.
How teams usually do it
- Version checks in the client's connection code.
Evidence an auditor would accept
- Configuration and downgrade tests.
Common mistakes
- Falling back automatically when a server claims not to support the current version.
Not sure which requirements apply to your system? Take the assessment.
Requirement text from the OWASP AI Security Verification Standard, licensed under CC BY-SA 4.0. This guidance is shared under the same licence.