Ensure non-null JSON-RPC request IDs are enforced and included in audit logs

높음레벨 1자동mcp-server

설명

The protocol's JSON-RPC id rules are enforced, and the request id is recorded in the audit log. A request id must be a string or an integer, must not be null, and must not match the id of another request the sender has issued but not yet received a response for. The uniqueness requirement covers only requests still in flight: once a request completes, its id may be reused, so enforcement applies to ids awaiting a response rather than to every id ever seen. A server that receives a null id, or an id that collides with one of its own outstanding requests, rejects the message as a JSON-RPC Invalid Request with error code -32600 and HTTP 400. The JSON-RPC request id is recorded on each audit-log entry so a logged event can be tied back to the request that produced it. Two kinds of bad request id break the correlation between a request and its response. An id that is null cannot be matched...

점검 방법

감사 방식: 셸 명령

shell

cfg="${MCP_CONFIG:-/etc/mcp/server.json}"; [ -f "$cfg" ] || { echo "missing $cfg (set MCP_CONFIG)"; exit 1; }; grep -Eq '"cis_7_1_2"|"protocolVersion"|"capabilities"|"auth"' "$cfg" && echo compliant || echo "non-compliant: section 7.1.2"

예상 출력: compliant

조치 방법

조치 방식: 가이드 또는 인프라 패치

Configure the server to reject a request whose id is null, or whose id matches one still awaiting a response, returning a JSON-RPC Invalid Request with error code -32600 and HTTP 400. For that check, track only the ids of requests still awaiting a response, and release an id for reuse once its response has been sent, rather than retaining every id seen. Record the JSON-RPC request id on every audit-log entry. Id-rule enforcement is typically provided by a conformant SDK, so the remediation is usually a matter of not overriding it and adding the request id to the log schema.

속성

운영 체제: 모두
태그: ailoggingmcpmcp-server
참고 자료: CIS MCP Server Benchmark v1.0.0 - 7.1.2 Ensure non-null JSON-RPC request IDs are enforced and included in audit logs

이 호스트 점검하기

감사 권한이 있는 시스템에서 실행하세요. 스캔은 읽기 전용입니다.

shell

tmaegis scan --target mcp-server