OWASP AISVS 1.01

AISVS 1.01 updates the 1.0 standard within the existing 12-chapter structure. It contains 213 active chapter requirements, with 23 additions and one removal since 1.0, plus 69 requirements in Appendix C.

• MCP security: expands C10, referencing specification revision 2026-07-28. Changes cover requestState integrity and single use where required, OAuth credential binding, proxy authorization isolation, endpoint-bound consent, downgrade resistance, mirrored-header validation, bounded schema processing, external schema references, cache isolation, and secure elicitation. Tool discovery now uses the requester's authorized scopes, with responses varying only by authorization context, never by connection.
• Agent authorization and execution: makes runtime enforcement explicit for per-tool quotas and timeouts; tightens self-modification boundaries, approval validation, and approval-key isolation; and requires action chains to be established outside the gated agent's control. Adds controls for action-chain expansion (C9.2.11), service-side isolation of agent-writable state (C9.3.9), and delegation bounded by the delegating agent's current authority (C9.5.7).
• Input, output, and memory: ties character allow-lists to supported languages and use cases, prevents untrusted content from gaining instruction priority through retrieval, tool processing, or later conversation turns, and extends source validation for agent/tool writes to trusted memory to every component reachable from agent execution. When an AI response determines whether an action proceeds, applications must not perform it if the AI refuses, reports failure, or returns a response the application cannot correctly interpret (C7.1.3).
• Adversarial evaluation and extraction defense: adds comparable no-attack evaluation results (C11.1.6) and server-side limits on caller-supplied sampling and decoding parameters (C11.3.5).
• AI coding-agent credentials: adds scheduled credential scanning of on-disk session records (AC.3.7) and extends automatic credential rotation to secrets found in those records (AC.14.2).
• Supporting material: expands the glossary and controls inventory, corrects Appendix C mappings to ASVS 5.0, and updates LLM Top 10 references to 2026. Scope guidance points to the OWASP AI Testing Guide for testing procedures and ASVS 5.0 V10 for general OAuth controls.

For assessments moving from 1.0:

• Level 1 additions: C10.2.8, C10.4.11, C10.4.14, and C10.4.19. Existing requirements C10.2.7 and C10.3.3 move from Level 2 to Level 1.
• Token handling changes: C10.2.7 replaces the blanket prohibition on passing through client-received access tokens. It now requires MCP servers to accept only tokens explicitly issued for them and prohibits passing tokens issued for other services to downstream APIs.
• Human approval scope: C9.2.1 no longer requires approval solely because an action is high-impact; privileged or irreversible actions still require explicit human approval at Level 1. High-impact actions remain subject to reversibility classification and enforcement at Level 2 (C9.2.3 and C9.2.4), which can block, restrict, or require approval.
• Removal: C10.2.6 is removed, with its identifier retained as a placeholder.

Reassess revised requirements as well as additions, and cite the version explicitly, for example v1.01-C9.4.3. AISVS verification continues to assume ASVS verification at the matching level.

Download PDF · Read the standard

This GitHub release retrospectively records the original 1.01 release commit from #1191. The tag and PDF are immutable; creating this GitHub release did not change the published standard.