Per OWASP ASVS V5 + V5.3: implement input validation + output encoding. Requirements include (a) validate all input from untrusted sources for format + length + content + character set + (b) use parameterised queries + prepared statements against SQL/NoSQL/LDAP injection + (c) implement output encoding per context (HTML + URL + JSON + JavaScript + CSS + similar) against XSS + injection + (d) use safe markup libraries + Content Security Policy + Trusted Types + (e) validate file uploads (type + size + content + scanning) + sandbox processing + (f) protect against XML external entity (XXE) + deserialisation + template injection + Server-Side Request Forgery (SSRF) + (g) integrate with WAF + framework-provided protections.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.