How to meet it
OWASP AISVS v1.01
Model Context Protocol (MCP) Security · Secure Transport
Check protocol version before trusting headers
Verify that MCP intermediaries enforcing policy on mirrored request headers confirm that the protocol version indicates a revision requiring header and body validation before trusting those headers.
OWASP AISVS v1.01, requirement 10.3.6
In plain English
An intermediary that enforces policy using mirrored request headers should first confirm the protocol version requires those headers to be validated against the body.
What good looks like
- The intermediary checks the protocol version before trusting mirrored headers.
- Requests on older versions are handled without relying on those headers.
- Tests cover both versions.
How teams usually do it
- Version-aware rules in the proxy or gateway.
Evidence an auditor would accept
- Gateway rules and tests.
Common mistakes
- Trusting mirrored headers from clients on versions that do not validate them.
Not sure which requirements apply to your system? Take the assessment.
Requirement text from the OWASP AI Security Verification Standard, licensed under CC BY-SA 4.0. This guidance is shared under the same licence.