Ensure MCP protocol version is pinned and logged

So wird geprüft

Prüfmethode: Shell-Befehl

cfg="${MCP_CONFIG:-/etc/mcp/server.json}"; [ -f "$cfg" ] || { echo "missing $cfg (set MCP_CONFIG)"; exit 1; }; grep -Eq '"cis_1_1"|"protocolVersion"|"capabilities"|"auth"' "$cfg" && echo compliant || echo "non-compliant: section 1.1"

Erwartete Ausgabe

compliant

So wird behoben

Behebungsmethode: Anleitung oder Infrastruktur-Patch

Configure the deployment to reject any request that asserts a version outside the allowlist, omits it, or carries disagreeing header and body values, and to record the asserted version on every request. The version is asserted twice per Streamable HTTP POST, in the MCP-Protocol-Version header and in _meta under io.modelcontextprotocol/protocolVersion, and the two are required to match. The MCP server, or an L7 gateway able to inspect the body, rejects these in request-handling middleware: an out-of-allowlist version with -32022 (UnsupportedProtocolVersion), a header that disagrees with the body or a missing MCP-Protocol-Version header with -32020 (HeaderMismatch), and a request whose _meta omits the protocol version value with -32602 (Invalid params). All are rejected at HTTP 400. Record the asserted version, the request direction, and the client identity from _meta on every request, and ship the logs to the SIEM. The Audit reads the version from that _meta key, so a deployment that records it under a different name changes the Audit and this field together. Record the approved revision(s) in the enterprise MCP registry and export them to the newline-delimited allowlist the Audi...

Diesen Host prüfen

Führen Sie dies auf einem Rechner aus, den Sie prüfen dürfen. Der Scan ist schreibgeschützt.

tmaegis scan --target mcp-server