---
schema_version: "1"
id: f773ffd68f1c330ecb67ba443327700dba80041bbe8d08afa266e7aff30309f9
title: MCP Schema Validation Policy
collection: mulesoft
version: current
locale: en-us
portal_url: https://docs.salesforce.com/mulesoft/current/en-us/gateway/1.13/policies-included-mcp-schema-validation.md
canonical_url: https://docs.mulesoft.com/gateway/1.13/policies-included-mcp-schema-validation
source_site: docs.mulesoft.com
content_type: documentation
content_hash: 942ce4bfd6f1b3a588aae377a60bdcc1d69b3431b0f4f9621efac9d891c1cb46
description: MuleSoft Documentation Site
release: "1.13"
latest: false
---
---
product: Omni Gateway
version: 1.13
keywords: api gateway, flex gateway, gateway, policy
---

# MCP Schema Validation Policy

> For the full documentation index, see: https://docs.mulesoft.com/llms.txt

<table><colgroup><col> <col></colgroup><tbody><tr><td><p><strong>Policy Name</strong></p></td><td><p>MCP Schema Validation</p></td></tr><tr><td><p><strong>Summary</strong></p></td><td><p>Validates MCP requests to ensure they conform to the MCP specification</p></td></tr><tr><td><p><strong>Category</strong></p></td><td><p>MCP</p></td></tr><tr><td><p><strong>First Omni Gateway version available</strong></p></td><td><p>v1.9.3</p></td></tr><tr><td><p><strong>Release Notes</strong></p></td><td><p><a href="https://docs.mulesoft.com/release-notes/gateway/policies/mcp-schema-validation-release-notes">MCP Schema Validation</a></p></td></tr><tr><td><p><strong>Returned Status Codes</strong></p></td><td></td></tr></tbody></table>

> [!NOTE] This policy supports Model Context Protocol (MCP) version 2025-06-18 and earlier. To learn
> more about MCP, see [MCP Specification](https://modelcontextprotocol.io/specification/2025-06-18).

## Summary

The MCP Schema Validation policy validates that every incoming request complies with JsonRPC MCP
protocol.

When **Validate Tool Schema** is enabled, the policy also:

- Validates tool invocation request parameters against the JSON schema of the tool.

- Returns the tools/list MCP request without having to send the request to the upstream MCP Server.

When the policy can’t validate the request, it returns an
[MCP Error Response](https://modelcontextprotocol.io/specification/2025-11-25/basic#error-responses).

### Omni Gateway Local Mode

The MCP Schema Validation policy isn’t supported in Local Mode.

### Managed Omni Gateway and Omni Gateway Connected Mode

When you apply the policy from the UI, the following parameters are displayed:

<table><colgroup><col> <col></colgroup><thead><tr><th>Parameter</th><th>Description</th></tr></thead><tbody><tr><td><div><div><p>Validate Tool Schema</p></div></div></td><td><div><div><p>When enabled, the policy:</p></div><div><ul><li><p>Validates tool invocation request parameters against the JSON schema of the tool.</p></li><li><p>Returns the tools/list MCP request without having to send the request to the upstream MCP Server.</p></li></ul></div></div></td></tr><tr><td><div><div><p>Tool Poisoning Detection</p></div></div></td><td><div><div><p>Detects tool-poisoning attacks against MCP <code>tools/list</code> responses by pinning the trusted tool set from the API’s Anypoint Exchange asset and comparing every backend <code>tools/list</code> response against it. Here, the trusted asset is the cached Anypoint Exchange asset specification that the API is bound to, which is the same asset used to pin the trusted tool set. Detection runs against the backend response only when <strong>Validate Tool Schema</strong> is disabled. When <strong>Validate Tool Schema</strong> is enabled, <code>tools/list</code> is served from the trusted asset and detection is inactive. To learn more, see <a href="#tool-poisoning-detection">Configure Tool Poisoning Detection</a>.</p></div></div></td></tr></tbody></table>

### Configure Tool Poisoning Detection

Configure **Tool Poisoning Detection** to detect three types of tool-poisoning findings. Each
detection type is disabled by default.

For each detection type, configure an **Action** that determines how the policy handles the response
when it finds a poisoning attempt:

- `LogOnly`: Records the finding and leaves the response unchanged.

- `RemoveTool`: Removes only the affected tool from the response.

- `BlockResponse`: Replaces the entire `tools/list` response with a JSON-RPC error.

<table><colgroup><col> <col> <col></colgroup><thead><tr><th>Parameter</th><th>Description</th><th>Default</th></tr></thead><tbody><tr><td><div><div><p>Descriptor Drift Detection</p></div></div></td><td><div><div><p>Detects when a pinned tool’s name, description, input schema, output schema, or annotations no longer match the pinned Exchange descriptor (a "rug pull"). This is the highest-confidence finding type. Configure <strong>Enabled</strong> to activate detection and <strong>Action</strong> to set the response handling.</p></div></div></td><td><div><div><p>Disabled</p></div></div></td></tr><tr><td><div><div><p>Shadow Tool Name Detection</p></div></div></td><td><div><div><p>Detects tools that are present at runtime but absent from the pin, and flags those whose name is a near-twin of a pinned tool’s name as shadowing. Configure <strong>Enabled</strong> to activate detection and <strong>Action</strong> to set the response handling. Configure <strong>Max Edit Distance</strong> to set the maximum Levenshtein distance from a pinned tool name for an unpinned tool to be flagged as shadowing rather than merely unpinned. A value of <code>0</code> disables the shadowing annotation. The minimum value is <code>0</code> and the maximum value is <code>10</code>.</p></div></div></td><td><div><div><p>Disabled, <strong>Max Edit Distance</strong> <code>2</code></p></div></div></td></tr><tr><td><div><div><p>Prompt Injection Detection</p></div></div></td><td><div><div><p>Scans tool descriptor text fields for prompt-injection heuristics. Disabled by default because it is the lowest-confidence, highest-false-positive-risk finding type. Configure <strong>Enabled</strong> to activate detection and <strong>Action</strong> to set the response handling.</p></div></div></td><td><div><div><p>Disabled</p></div></div></td></tr><tr><td><div><div><p>Max Tools Per Response</p></div></div></td><td><div><div><p>Sets the upper bound on how many tools in a single <code>tools/list</code> response the policy evaluates. Tools beyond this bound pass through unexamined, and the policy logs the truncation. The minimum value is <code>1</code>.</p></div></div></td><td><div><div><p><code>200</code></p></div></div></td></tr></tbody></table>