How to meet it
OWASP AISVS v1.01
Model Context Protocol (MCP) Security · Schema, Message, and Input Validation
Validate MCP responses against their schema
Verify that MCP tools/list and tools/call responses are validated against their declared schemas before being injected into the model context.
OWASP AISVS v1.01, requirement 10.4.1
In plain English
Check tool lists and tool results from MCP servers against their declared schemas before they go into the model's context.
What good looks like
- Responses are validated before use.
- Invalid responses are rejected.
- Rejections are logged.
How teams usually do it
- Schema validation in the MCP client.
Evidence an auditor would accept
- Client code and tests with malformed responses.
Common mistakes
- Passing raw server responses into the prompt.
Not sure which requirements apply to your system? Take the assessment.
Requirement text from the OWASP AI Security Verification Standard, licensed under CC BY-SA 4.0. This guidance is shared under the same licence.