TMA-MCP-7.1.1

Ensure lifecycle and invocation metadata is recorded

높음레벨 1자동mcp-server

설명

Structured audit-log entries are generated for MCP lifecycle events and invocation operations. Under the 2026-07-28 stateless model, server/discover calls and the per-request protocol metadata in each request's _meta (io.modelcontextprotocol/protocolVersion, io.modelcontextprotocol/clientCapabilities, and io.modelcontextprotocol/clientInfo) are recorded, together with the server identity each result reports in _meta as io.modelcontextprotocol/serverInfo. The invocation operations tools/call, resources/read, and prompts/get are recorded (input metadata, but not full argument payloads for privacy-sensitive tools), along with authentication events, elicitation exchanges, human approval and denial decisions, and Task lifecycle events. Every entry carries a synchronized timestamp, an event type, the producing server's identity, and a correlation identifier tying one request's events togeth...

점검 방법

감사 방식: 셸 명령

shell

cfg="${MCP_CONFIG:-/etc/mcp/server.json}"; [ -f "$cfg" ] || { echo "missing $cfg (set MCP_CONFIG)"; exit 1; }; grep -Eq '"cis_7_1_1"|"protocolVersion"|"capabilities"|"auth"' "$cfg" && echo compliant || echo "non-compliant: section 7.1.1"

예상 출력: compliant

조치 방법

조치 방식: 가이드 또는 인프라 패치

Standardize the audit-log schema across all MCP components so every entry carries a timestamp, a correlation identifier, an event type, the server identity, and the event- specific metadata, and extend it to cover elicitation, approval and denial, and Task lifecycle events. Use the JSON-RPC request id or a deployment correlation identifier for the correlation field, and where distributed tracing is available propagate the W3C traceparent in _meta and record the trace and span identifiers alongside it. Capture logs at the server through stderr or an OpenTelemetry exporter rather than the deprecated MCP logging utility, and ship them to a centralized store with integrity controls such as write-once storage or signed log batches. The exact mechanism is platform-specific, so this Recommendation states the required schema and pipeline rather than a portable command.

속성

운영 체제: 모두
태그: aimcpmcp-server
참고 자료: CIS MCP Server Benchmark v1.0.0 - 7.1.1 Ensure lifecycle and invocation metadata is recorded

이 호스트 점검하기

감사 권한이 있는 시스템에서 실행하세요. 스캔은 읽기 전용입니다.

shell

tmaegis scan --target mcp-server