How to meet it
OWASP AISVS v1.01
Model Context Protocol (MCP) Security · Schema, Message, and Input Validation
Reject headers that don't match the body
Verify that MCP servers reject requests where mirrored request headers do not match the corresponding request body values, after decoding any encoded header values.
OWASP AISVS v1.01, requirement 10.4.12
In plain English
Reject requests where mirrored headers do not match the request body, after decoding any encoded header values.
What good looks like
- Headers are decoded and compared with the body.
- Mismatches are rejected.
- Rejections are logged.
How teams usually do it
- Validation middleware in the server.
Evidence an auditor would accept
- Tests with mismatched and encoded headers.
Common mistakes
- Comparing before decoding, so encoded values slip through.
Not sure which requirements apply to your system? Take the assessment.
Requirement text from the OWASP AI Security Verification Standard, licensed under CC BY-SA 4.0. This guidance is shared under the same licence.