Ensure legacy Streamable HTTP session and stream- resumption mechanisms are disabled

So wird geprüft

Prüfmethode: Shell-Befehl

cfg="${MCP_CONFIG:-/etc/mcp/server.json}"; [ -f "$cfg" ] || { echo "missing $cfg (set MCP_CONFIG)"; exit 1; }; grep -Eq '"cis_5_2_3"|"protocolVersion"|"capabilities"|"auth"' "$cfg" && echo compliant || echo "non-compliant: section 5.2.3"

Erwartete Ausgabe

compliant

So wird behoben

Behebungsmethode: Anleitung oder Infrastruktur-Patch

For the 2026-07-28 revision, do not implement resumable streams or protocol-level sessions. Reject a standalone GET and a DELETE on the MCP endpoint with 405, ignore a Last-Event-ID header, and neither mint nor echo an Mcp-Session-Id header. Where a deployment streams responses, scope each streamed response to its originating authenticated request and maintain per-identity separation so events cannot be retrieved across identities. Where a tool uses the multi round-trip pattern, bind the requestState blob to the originating identity and authorize it on the follow-up call. Where the SDK in use exposes no server-side switch for the legacy surface, enforce the rejection at a front proxy or gateway, returning 405 to a standalone GET or DELETE on the MCP endpoint and stripping Mcp-Session-Id and Last-Event-ID before the origin. Gateway enforcement covers only paths that traverse the gateway, so restrict direct network reach to the origin where this layer is the enforcement point. This is server middleware and configuration, and there is no portable command.

Diesen Host prüfen

Führen Sie dies auf einem Rechner aus, den Sie prüfen dürfen. Der Scan ist schreibgeschützt.

tmaegis scan --target mcp-server