Ensure MCP client and server identity metadata is captured and validated against the asset inventory

How it is checked

Audit method: Shell command

cfg="${MCP_CONFIG:-/etc/mcp/server.json}"; [ -f "$cfg" ] || { echo "missing $cfg (set MCP_CONFIG)"; exit 1; }; grep -Eq '"cis_1_4"|"protocolVersion"|"capabilities"|"auth"' "$cfg" && echo compliant || echo "non-compliant: section 1.4"

Expected output

compliant

How it is fixed

Fix method: Guidance or infrastructure patch

Configure the MCP server, the host, or an application-layer gateway able to read the JSON body to record clientInfo from each request and serverInfo from each response into the audit log, with a correlation ID on each entry. The identity travels in the JSON body, not in an HTTP header, so a plain reverse proxy cannot capture it. Configure the approved clients and servers to emit these fields. Both are optional, and supported Tier 1 SDKs commonly send them unless configured otherwise, so confirm nothing has disabled them. Export the approved identities from the registry to two newline-delimited files at the paths the Audit reads, one name|version pair per line, servers in one file and clients in the other, using Unix line endings. Generate the export from the registry rather than by hand, and enforce a registry naming policy that excludes the pipe character, carriage returns, and line breaks so no identity can break the one-pair-per-line format. Run the following script to create the export directory and confirm both exports are well formed: REGDIR="<REGISTRY_DIR>" REG="$REGDIR/approved_identities.txt" CREG="$REGDIR/approved_client_identities.txt" mkdir -p "$REGDIR" missing="" [...

Check this host

Run this on a machine you are allowed to audit. The scan is read-only.

tmaegis scan --target mcp-server