Ensure MCP Apps permission requests default-deny, all app-to-host messages are logged, and high-risk channels are consented

점검 방법

감사 방식: 수동 검토

이 권장 사항은 자동으로 점검할 수 없습니다. --include-manual 옵션을 전달하면 스캔 결과에 이 지침과 함께 표시됩니다.

Confirm by host configuration review that requested permissions are default-deny and granted only on a recorded user decision, that all app-to-host messages are logged with attribution, and that the two high-risk channels are consented. Attempt an app tools/call for a tool whose declared visibility does not include "app" and confirm the host rejects it, and confirm a tool whose visibility excludes "model" does not appear in the agent's tool list. Run the following command: LOG="<HOST_APP_LOG>" command -v jq >/dev/null 2>&1 || { echo "ERROR: jq is required and not installed (cannot verify)"; exit 0; } [ -s "$LOG" ] || { echo "ERROR: host application log <HOST_APP_LOG> not found or empty (cannot verify)"; exit 0; } events=$(grep -E '"event":"app_permission"|"event":"app_message"' "$LOG") n=$(printf '%s\n' "$events" | grep -c .) [ "$n" -gt 0 ] || { echo "REVIEW: no MCP Apps permission or message events found (extension may not be in use)"; exit 0; } printf '%s\n' "$events" | jq -e . >/dev/null 2>&1 || { echo "ERROR: records are not parseable (cannot verify)"; exit 0; } echo "count: $n app permission/message events in window" autogrant=$(printf '%s\n' "$events" | jq -c 'select(.even...

조치 방법

조치 방식: 가이드 또는 인프라 패치

These are host configuration and host implementation settings, with no portable command. Configure the host to deny all four MCP Apps permissions by default and to grant one only on an explicit per-permission user decision recorded with a user decision source, never automatically from the resource's request. Log every app-to-host message with the requesting server identity, and gate the two high-risk channels, ui/message and ui/update-model-context, behind an explicit user consent decision recorded with a user decision source. Enforce the _meta.ui.visibility declaration so that an app cannot call a tool whose visibility omits "app", and the agent's tool list omits any tool whose visibility omits "model".