Ensure Elicitation requests are consented, redacted, and identity-bound

Cómo se verifica

Método de auditoría: Revisión manual

Esta recomendación no se puede verificar automáticamente. Un escaneo la lista con estas instrucciones cuando se pasa --include-manual.

Inspect the elicitation logs for an explicit user decision, a completed redaction check, and the mode-specific fields, and confirm by configuration review that form-mode elicitation cannot request secrets, that such requests use URL mode, that URL-mode flows verify the completing user, and that rate limiting is applied. Set the field names to match the deployment's log schema if they differ. Run the following command: LOG="<MCP_AUDIT_LOG>" command -v jq >/dev/null 2>&1 || { echo "ERROR: jq is required and not installed (cannot verify)"; exit 0; } [ -s "$LOG" ] || { echo "ERROR: audit log <MCP_AUDIT_LOG> is missing or empty (cannot verify)"; exit 0; } events=$(grep -E '"event":"elicitation"' "$LOG") n=$(printf '%s\n' "$events" | grep -c .) [ "$n" -gt 0 ] || { echo "REVIEW: no elicitation events found (control not evidenced)"; exit 0; } printf '%s\n' "$events" | jq -e . >/dev/null 2>&1 || { echo "ERROR: elicitation records are not parseable (cannot verify)"; exit 0; } bad=$(printf '%s\n' "$events" | jq -c ' select( (.server_identity==null or .server_identity=="") or (((.mode//"")=="form" or (.mode//"")=="url")|not) or (((.decision//"")|test("^(accepted|declined|cancelled)$"))|not)...

Cómo se corrige

Método de corrección: Guía o parche de infraestructura

These are host and server configuration settings, with no portable command. Configure the host to present server-initiated elicitation with clear server attribution and to require an explicit user decision before form data is submitted or a URL is navigated to. Apply a redaction filter that removes API keys, passwords, and common PII formats from any surfaced context, and record that the redaction check ran. Rate-limit server-initiated elicitation. In the server's elicitation handling, route any request for secrets through URL mode and never form mode, and for URL-mode flows securely associate any stored state with the individual user and verify that the same user completes the flow, deriving identity from MCP authorization credentials where possible. Log every elicitation event with the server identity, the mode, the user's decision and its source, the redaction result, and the mode-specific fields (requestedSchema for form mode, the target origin or URL for URL mode).