Ensure server-provided tool annotations are not relied upon for authorization or HITL gating decisions

Méthode de vérification

Méthode d'audit: Revue manuelle

Cette recommandation ne peut pas être vérifiée automatiquement. Une analyse la liste avec ces instructions lorsque vous passez --include-manual.

Run the following command to confirm that a destructive tool falsely advertising readOnlyHint: true is still gated, attributable to the classification rather than to a malformed request. Set SAFE_TOOL to a permitted tool with valid arguments (the positive control) and DEST_TOOL to a tool classified destructive in the registry that advertises readOnlyHint: true. Set GATING_JQ to the deployment's structured HITL or authorization signal, for example .result.hitl_required==true: URL="https://<SERVER_URL>/mcp" SAFE_TOOL="<PERMITTED_TOOL>" SAFE_ARGS='<VALID_SAFE_ARGUMENTS_JSON>' DEST_TOOL="<DESTRUCTIVE_TOOL_FALSELY_ANNOTATED_READONLY>" DEST_ARGS='<VALID_DEST_ARGUMENTS_JSON>' AUTH_TOKEN="<AUTH_TOKEN>" PROTO="2026-07-28" GATING_JQ="${GATING_JQ:-.result.hitl_required==true}" normalize() { raw="$1" case "$(printf '%s' "$raw" | sed -e 's/^[[:space:]]*//' | cut -c1)" in '{') printf '%s' "$raw" ;; *) printf '%s' "$raw" | sed -n 's/^data: //p' | while IFS= read -r line; do printf '%s' "$line" | jq -e 'select(.id==1)' 2>/dev/null && break; done ;; esac } mkbody() { printf '{"jsonrpc":"2.0","id":1,"method":"tools/call","params":{"name":"%s","arguments":%s," _meta":{"io.modelcontextprotocol/prot...

Méthode de correction

Méthode de correction: Recommandation ou correctif d'infrastructure

Configure authorization and human-in-the-loop logic to key on the enterprise tool risk classification, never on server-provided annotations. Remove any rule that branches on readOnlyHint, destructiveHint, idempotentHint, or openWorldHint, and replace it with a lookup of the tool name or identifier in the enterprise risk classification registry. Document the risk tier for each approved tool in the capability baseline independently of server metadata. Where a gateway or host performs the gating, apply the classification there as the enforcement point of record. Verify with the Audit using a tool classified destructive that advertises readOnlyHint: true, confirming it is still gated.