How to meet it
OWASP AISVS v1.01
Model Context Protocol (MCP) Security · Schema, Message, and Input Validation
Don't fetch remote schema references
Verify that MCP implementations do not automatically dereference JSON Schema `$ref` values that resolve to network URIs, and that any opt-in external resolution is disabled by default and rejects loopback, link-local, and private network addresses.
OWASP AISVS v1.01, requirement 10.4.14
In plain English
Do not follow schema references that point to network addresses. If you must allow it, keep it off by default and block internal and loopback addresses.
What good looks like
- Remote references are not resolved by default.
- Any opt-in resolution blocks loopback, link-local and private addresses.
- The setting is tested.
How teams usually do it
- Disabling remote reference loading in the schema library.
Evidence an auditor would accept
- Configuration and tests with internal addresses.
Common mistakes
- Default library settings that fetch any URL in a schema.
Not sure which requirements apply to your system? Take the assessment.
Requirement text from the OWASP AI Security Verification Standard, licensed under CC BY-SA 4.0. This guidance is shared under the same licence.