Ensure MCP client and server identity metadata is captured and validated against the asset inventory

Cara pemeriksaan

Metode audit: Perintah shell

cfg="${MCP_CONFIG:-/etc/mcp/server.json}"; [ -f "$cfg" ] || { echo "missing $cfg (set MCP_CONFIG)"; exit 1; }; grep -Eq '"cis_1_4"|"protocolVersion"|"capabilities"|"auth"' "$cfg" && echo compliant || echo "non-compliant: section 1.4"

Output yang diharapkan

compliant

Cara perbaikan

Metode perbaikan: Panduan atau patch infrastruktur

Configure the MCP server, the host, or an application-layer gateway able to read the JSON body to record clientInfo from each request and serverInfo from each response into the audit log, with a correlation ID on each entry. The identity travels in the JSON body, not in an HTTP header, so a plain reverse proxy cannot capture it. Configure the approved clients and servers to emit these fields. Both are optional, and supported Tier 1 SDKs commonly send them unless configured otherwise, so confirm nothing has disabled them. Export the approved identities from the registry to two newline-delimited files at the paths the Audit reads, one name|version pair per line, servers in one file and clients in the other, using Unix line endings. Generate the export from the registry rather than by hand, and enforce a registry naming policy that excludes the pipe character, carriage returns, and line breaks so no identity can break the one-pair-per-line format. Run the following script to create the export directory and confirm both exports are well formed: REGDIR="<REGISTRY_DIR>" REG="$REGDIR/approved_identities.txt" CREG="$REGDIR/approved_client_identities.txt" mkdir -p "$REGDIR" missing="" [...

Periksa host ini

Jalankan ini pada mesin yang diizinkan untuk Anda audit. Pemindaian bersifat hanya baca.

tmaegis scan --target mcp-server