How to meet it
OWASP AISVS v1.01
Model Context Protocol (MCP) Security · Schema, Message, and Input Validation
Reject unknown or oversized MCP parameters
Verify that MCP servers reject unrecognized or oversized parameters in function calls.
OWASP AISVS v1.01, requirement 10.4.3
In plain English
MCP servers should reject unknown or oversized parameters in tool calls.
What good looks like
- Unknown parameters cause rejection.
- Size limits apply to each parameter.
- Errors are clear and logged.
How teams usually do it
- Strict schemas that disallow additional properties.
Evidence an auditor would accept
- Schemas and tests.
Common mistakes
- Ignoring unknown parameters silently, which hides probing.
Not sure which requirements apply to your system? Take the assessment.
Requirement text from the OWASP AI Security Verification Standard, licensed under CC BY-SA 4.0. This guidance is shared under the same licence.