TMA-MCP-1.4

Ensure MCP client and server identity metadata is captured and validated against the asset inventory

높음레벨 1자동mcp-server

설명

The self-asserted identity metadata that MCP clients and servers exchange is captured and validated against the identities and capability profiles in the enterprise MCP registry. Under the 2026-07-28 revision, a client identifies itself in _meta["io.modelcontextprotocol/clientInfo"] on each request and a server in _meta["io.modelcontextprotocol/serverInfo"] on each response. Both fields carry a name and a version, and both are optional in the schema, so an implementation configured not to send one is still conforming. The specification does not define how a receiver treats a malformed identity value, and handling varies by implementation. This Recommendation therefore never accepts a malformed value as an approved inventory identity and records it as a metadata-validation finding. Server capabilities and supported protocol versions are obtained separately from the server/discover resu...

점검 방법

감사 방식: 셸 명령

shell

cfg="${MCP_CONFIG:-/etc/mcp/server.json}"; [ -f "$cfg" ] || { echo "missing $cfg (set MCP_CONFIG)"; exit 1; }; grep -Eq '"cis_1_4"|"protocolVersion"|"capabilities"|"auth"' "$cfg" && echo compliant || echo "non-compliant: section 1.4"

예상 출력: compliant

조치 방법

조치 방식: 가이드 또는 인프라 패치

Configure the MCP server, the host, or an application-layer gateway able to read the JSON body to record clientInfo from each request and serverInfo from each response into the audit log, with a correlation ID on each entry. The identity travels in the JSON body, not in an HTTP header, so a plain reverse proxy cannot capture it. Configure the approved clients and servers to emit these fields. Both are optional, and supported Tier 1 SDKs commonly send them unless configured otherwise, so confirm nothing has disabled them. Export the approved identities from the registry to two newline-delimited files at the paths the Audit reads, one name|version pair per line, servers in one file and clients in the other, using Unix line endings. Generate the export from the registry rather than by hand, and enforce a registry naming policy that excludes the pipe character, carriage returns, and line breaks so no identity can break the one-pair-per-line format. Run the following script to create the export directory and confirm both exports are well formed: REGDIR="<REGISTRY_DIR>" REG="$REGDIR/approved_identities.txt" CREG="$REGDIR/approved_client_identities.txt" mkdir -p "$REGDIR" missing="" [...

속성

운영 체제: 모두
태그: aimcpmcp-server
참고 자료: CIS MCP Server Benchmark v1.0.0 - 1.4 Ensure MCP client and server identity metadata is captured and validated against the asset inventory

이 호스트 점검하기

감사 권한이 있는 시스템에서 실행하세요. 스캔은 읽기 전용입니다.

shell

tmaegis scan --target mcp-server