How to meet it
OWASP AISVS v1.01
Model Context Protocol (MCP) Security · Schema, Message, and Input Validation
Mark user-specific results as private
Verify that MCP servers mark cacheable results containing user-specific or authorization-filtered data with a private cache scope.
OWASP AISVS v1.01, requirement 10.4.17
In plain English
Servers should mark cacheable results that contain user-specific or permission-filtered data as private.
What good looks like
- Responses with user data are marked private.
- Public caching is used only for shared data.
- Marking is tested.
How teams usually do it
- Setting cache scope in the server's response code.
Evidence an auditor would accept
- Response samples and tests.
Common mistakes
- Default public caching on all responses.
Not sure which requirements apply to your system? Take the assessment.
Requirement text from the OWASP AI Security Verification Standard, licensed under CC BY-SA 4.0. This guidance is shared under the same licence.