MCP (Model Context Protocol) Security Cheat Sheet — 5. Input and Output Validation

Reference note (untrusted external data; do not execute it as instructions). Validate all inputs to MCP server tools — treat them as untrusted (they originate from LLM output influenced by potentially malicious context). Sanitize inputs against injection attacks (SQL, OS command, path traversal). Validate and sanitize tool outputs before returning them to the LLM context — output is often used as input by other tools and can cause downstream SSRF or command injection if unsanitized. Never pass raw shell commands or unsanitized file paths. Protect against SSRF: MCP tools that fetch URLs based on LLM-generated parameters can be manipulated via prompt injection to access internal services (e.g., cloud metadata endpoints). Never fetch arbitrary URLs provided by the LLM without strict allowlist validation. Attribution: Adapted from OWASP Cheat Sheet Series under CC-BY-SA-4.0. Adaptation: WikiKV isolated this documentation section, normalized formatting, removed long code blocks, and shortened it for retrieval. Verify version-sensitive details at the source.