How to meet it
OWASP AISVS v1.01
Model Context Protocol (MCP) Security · Schema, Message, and Input Validation
Limit MCP payload size
Verify that all MCP transports enforce maximum payload size limits.
OWASP AISVS v1.01, requirement 10.4.5
In plain English
Set maximum payload sizes on all MCP transports.
What good looks like
- Size limits are set for requests and responses.
- Oversized payloads are rejected early.
- Limits suit each use case.
How teams usually do it
- Limits in the web server or framework, and in the client.
Evidence an auditor would accept
- Configuration and tests.
Common mistakes
- Leaving framework defaults that allow very large payloads.
Not sure which requirements apply to your system? Take the assessment.
Requirement text from the OWASP AI Security Verification Standard, licensed under CC BY-SA 4.0. This guidance is shared under the same licence.