Ensure lifecycle and invocation metadata is recorded

高レベル 1自動mcp-server

説明

Structured audit-log entries are generated for MCP lifecycle events and invocation operations. Under the 2026-07-28 stateless model, server/discover calls and the per-request protocol metadata in each request's _meta (io.modelcontextprotocol/protocolVersion, io.modelcontextprotocol/clientCapabilities, and io.modelcontextprotocol/clientInfo) are recorded, together with the server identity each result reports in _meta as io.modelcontextprotocol/serverInfo. The invocation operations tools/call, resources/read, and prompts/get are recorded (input metadata, but not full argument payloads for privacy-sensitive tools), along with authentication events, elicitation exchanges, human approval and denial decisions, and Task lifecycle events. Every entry carries a synchronized timestamp, an event type, the producing server's identity, and a correlation identifier tying one request's events togeth...

チェック方法

監査方法: シェルコマンド

shell

cfg="${MCP_CONFIG:-/etc/mcp/server.json}"; [ -f "$cfg" ] || { echo "missing $cfg (set MCP_CONFIG)"; exit 1; }; grep -Eq '"cis_7_1_1"|"protocolVersion"|"capabilities"|"auth"' "$cfg" && echo compliant || echo "non-compliant: section 7.1.1"

期待される出力: compliant

修正方法

修正方法: ガイダンスまたは IaC パッチ

Standardize the audit-log schema across all MCP components so every entry carries a timestamp, a correlation identifier, an event type, the server identity, and the event- specific metadata, and extend it to cover elicitation, approval and denial, and Task lifecycle events. Use the JSON-RPC request id or a deployment correlation identifier for the correlation field, and where distributed tracing is available propagate the W3C traceparent in _meta and record the trace and span identifiers alongside it. Capture logs at the server through stderr or an OpenTelemetry exporter rather than the deprecated MCP logging utility, and ship them to a centralized store with integrity controls such as write-once storage or signed log batches. The exact mechanism is platform-specific, so this Recommendation states the required schema and pipeline rather than a portable command.

プロパティ

オペレーティングシステム: すべて
タグ: aimcpmcp-server
参照: CIS MCP Server Benchmark v1.0.0 - 7.1.1 Ensure lifecycle and invocation metadata is recorded

このホストをチェック

監査が許可されているマシンで実行してください。スキャンは読み取り専用です。

shell

tmaegis scan --target mcp-server