Ensure Elicitation requests are consented, redacted, and identity-bound

Cara pemeriksaan

Metode audit: Tinjauan manual

Rekomendasi ini tidak dapat diperiksa secara otomatis. Pemindaian akan menampilkannya beserta petunjuk ini saat Anda memberikan opsi --include-manual.

Inspect the elicitation logs for an explicit user decision, a completed redaction check, and the mode-specific fields, and confirm by configuration review that form-mode elicitation cannot request secrets, that such requests use URL mode, that URL-mode flows verify the completing user, and that rate limiting is applied. Set the field names to match the deployment's log schema if they differ. Run the following command: LOG="<MCP_AUDIT_LOG>" command -v jq >/dev/null 2>&1 || { echo "ERROR: jq is required and not installed (cannot verify)"; exit 0; } [ -s "$LOG" ] || { echo "ERROR: audit log <MCP_AUDIT_LOG> is missing or empty (cannot verify)"; exit 0; } events=$(grep -E '"event":"elicitation"' "$LOG") n=$(printf '%s\n' "$events" | grep -c .) [ "$n" -gt 0 ] || { echo "REVIEW: no elicitation events found (control not evidenced)"; exit 0; } printf '%s\n' "$events" | jq -e . >/dev/null 2>&1 || { echo "ERROR: elicitation records are not parseable (cannot verify)"; exit 0; } bad=$(printf '%s\n' "$events" | jq -c ' select( (.server_identity==null or .server_identity=="") or (((.mode//"")=="form" or (.mode//"")=="url")|not) or (((.decision//"")|test("^(accepted|declined|cancelled)$"))|not)...

Cara perbaikan

Metode perbaikan: Panduan atau patch infrastruktur

These are host and server configuration settings, with no portable command. Configure the host to present server-initiated elicitation with clear server attribution and to require an explicit user decision before form data is submitted or a URL is navigated to. Apply a redaction filter that removes API keys, passwords, and common PII formats from any surfaced context, and record that the redaction check ran. Rate-limit server-initiated elicitation. In the server's elicitation handling, route any request for secrets through URL mode and never form mode, and for URL-mode flows securely associate any stored state with the individual user and verify that the same user completes the flow, deriving identity from MCP authorization credentials where possible. Log every elicitation event with the server identity, the mode, the user's decision and its source, the redaction result, and the mode-specific fields (requestedSchema for form mode, the target origin or URL for URL mode).