How to meet it
OWASP AISVS v1.01
Model Context Protocol (MCP) Security · Schema, Message, and Input Validation
Strict schema validation on MCP servers
Verify that all MCP servers enforce strict schema validation.
OWASP AISVS v1.01, requirement 10.4.4
In plain English
Every MCP server validates every request against a strict schema.
What good looks like
- All tools have strict input schemas.
- Validation runs before any processing.
- Failures are rejected.
How teams usually do it
- Schema validation middleware in the server framework.
Evidence an auditor would accept
- Server configuration.
Common mistakes
- Validating some tools and not others.
Not sure which requirements apply to your system? Take the assessment.
Requirement text from the OWASP AI Security Verification Standard, licensed under CC BY-SA 4.0. This guidance is shared under the same licence.