How to meet it
OWASP AISVS v1.01
Model Context Protocol (MCP) Security · Schema, Message, and Input Validation
Drop tools with invalid header annotations
Verify that MCP clients reject tool definitions containing invalid mirrored-header annotations, excluding the affected tool rather than the entire tool list.
OWASP AISVS v1.01, requirement 10.4.11
In plain English
If a tool definition has invalid mirrored-header annotations, drop that tool and keep the rest of the list.
What good looks like
- Invalid annotations are detected.
- Only the affected tool is excluded.
- The exclusion is logged.
How teams usually do it
- Per-tool validation in the client.
Evidence an auditor would accept
- Tests with one invalid tool definition.
Common mistakes
- Rejecting the whole list, which teams then work around by switching validation off.
Not sure which requirements apply to your system? Take the assessment.
Requirement text from the OWASP AI Security Verification Standard, licensed under CC BY-SA 4.0. This guidance is shared under the same licence.