TMA-MCP-2.2

Ensure TLS is required for HTTP and plaintext is disallowed

보통레벨 1자동mcp-server

설명

MCP Streamable HTTP servers that carry sensitive data are expected to be deployed over a secure transport. The MCP specification requires Origin validation and recommends authentication for HTTP deployments, but it does not prescribe a minimum TLS protocol revision. TLS 1.2 or higher is the baseline established here, consistent with current enterprise TLS configuration guidance. A server that serves plaintext HTTP, negotiates a legacy TLS version, or presents an expired certificate does not meet this baseline. Transmitting MCP messages, OAuth tokens, and tool-call payloads over unencrypted HTTP exposes all of it to interception. An attacker positioned on the network can read or modify every message. Authorization tokens captured from plaintext can then be replayed to invoke tools as the victim. TLS is the baseline defense against both. Permitting TLS 1.0 or 1.1 reopens known transport...

점검 방법

감사 방식: 셸 명령

shell

cfg="${MCP_CONFIG:-/etc/mcp/server.json}"; [ -f "$cfg" ] || { echo "missing $cfg (set MCP_CONFIG)"; exit 1; }; grep -Eq '"cis_2_2"|"protocolVersion"|"capabilities"|"auth"' "$cfg" && echo compliant || echo "non-compliant: section 2.2"

예상 출력: compliant

조치 방법

조치 방식: 가이드 또는 인프라 패치

Terminate TLS in front of the MCP server and redirect or refuse plaintext. The following nginx example defines the upstream, redirects port 80 to HTTPS, restricts protocols to TLS 1.2 and 1.3, and proxies the MCP path. Substitute the upstream address, the server name, and the certificate paths: upstream mcp_upstream { server <MCP_UPSTREAM_ADDR>; } server { listen 80; server_name <MCP_SERVER_NAME>; return 308 https://$host$request_uri; } server { listen 443 ssl; server_name <MCP_SERVER_NAME>; ssl_protocols TLSv1.2 TLSv1.3; ssl_ciphers HIGH:!aNULL:!MD5; ssl_certificate <TLS_CERTIFICATE_PATH>; ssl_certificate_key <TLS_CERTIFICATE_KEY_PATH>; location /mcp { proxy_pass http://mcp_upstream; } } After applying the configuration, run the Audit to confirm all three probes print PASS.

속성

운영 체제: 모두
태그: aimcpmcp-servertls
참고 자료: CIS MCP Server Benchmark v1.0.0 - 2.2 Ensure TLS is required for HTTP and plaintext is disallowed

이 호스트 점검하기

감사 권한이 있는 시스템에서 실행하세요. 스캔은 읽기 전용입니다.

shell

tmaegis scan --target mcp-server