Ensure server capability baseline is established and documented

점검 방법

감사 방식: 수동 검토

이 권장 사항은 자동으로 점검할 수 없습니다. --include-manual 옵션을 전달하면 스캔 결과에 이 지침과 함께 표시됩니다.

Compare the full capability configuration the server advertises through server/discover against the approved baseline, and flag any deviation as drift. The comparison covers every nested setting, not only the names, so a change to a value such as tools.listChanged or an extension setting is drift even though no name changed. Maintain the baseline per server as the canonical JSON capability object, for example <BASELINE_DIR>/<SERVER>.capabilities.json. Run the following script to retrieve the advertised configuration and compare it against the baseline: MCP_URL="https://<SERVER_URL>/mcp" BASELINE="<BASELINE_DIR>/<SERVER>.capabilities.json" LEAF='(paths(type | IN("string","number","boolean","null")), paths(type == "object" and length == 0), paths(type == "array" and length == 0)) as $p | ($p | tojson) + "\t" + (getpath($p) | tojson)' resp=$(curl -sS --connect-timeout 5 --max-time 20 -X POST "$MCP_URL" \ -H 'Content-Type: application/json' \ -H 'Accept: application/json, text/event-stream' \ -H 'MCP-Protocol-Version: 2026-07-28' \ -H 'Mcp-Method: server/discover' \ -d '{"jsonrpc":"2.0","id":1,"method":"server/discover","params":{"_meta":{"io.modelconte xtprotocol/protocolVersion":"...

조치 방법

조치 방식: 가이드 또는 인프라 패치

Establish the baseline from a server in a known-good state, have it reviewed, and store it in the enterprise registry under change control. Run the following script to capture the baseline as the canonical JSON capability object. Capturing from a drifted server writes the drift into the baseline, so capture only from a server in its approved state. The script leaves any existing baseline untouched if the configuration cannot be retrieved or the server advertises an empty set: MCP_URL="https://<SERVER_URL>/mcp" BASELINE="<BASELINE_DIR>/<SERVER>.capabilities.json" mkdir -p "$(dirname "$BASELINE")" LEAF='(paths(type | IN("string","number","boolean","null")), paths(type == "object" and length == 0), paths(type == "array" and length == 0)) as $p | $p | tojson' resp=$(curl -sS --connect-timeout 5 --max-time 20 -X POST "$MCP_URL" \ -H 'Content-Type: application/json' \ -H 'Accept: application/json, text/event-stream' \ -H 'MCP-Protocol-Version: 2026-07-28' \ -H 'Mcp-Method: server/discover' \ -d '{"jsonrpc":"2.0","id":1,"method":"server/discover","params":{"_meta":{"io.modelconte xtprotocol/protocolVersion":"2026-07- 28","io.modelcontextprotocol/clientInfo":{"name":"cis-benchmark- audi...