Ensure MCP client and server identity metadata is captured and validated against the asset inventory

Como é verificado

Método de auditoria: Comando shell

cfg="${MCP_CONFIG:-/etc/mcp/server.json}"; [ -f "$cfg" ] || { echo "missing $cfg (set MCP_CONFIG)"; exit 1; }; grep -Eq '"cis_1_4"|"protocolVersion"|"capabilities"|"auth"' "$cfg" && echo compliant || echo "non-compliant: section 1.4"

Saída esperada

compliant

Como é corrigido

Método de correção: Orientação ou patch de infraestrutura

Configure the MCP server, the host, or an application-layer gateway able to read the JSON body to record clientInfo from each request and serverInfo from each response into the audit log, with a correlation ID on each entry. The identity travels in the JSON body, not in an HTTP header, so a plain reverse proxy cannot capture it. Configure the approved clients and servers to emit these fields. Both are optional, and supported Tier 1 SDKs commonly send them unless configured otherwise, so confirm nothing has disabled them. Export the approved identities from the registry to two newline-delimited files at the paths the Audit reads, one name|version pair per line, servers in one file and clients in the other, using Unix line endings. Generate the export from the registry rather than by hand, and enforce a registry naming policy that excludes the pipe character, carriage returns, and line breaks so no identity can break the one-pair-per-line format. Run the following script to create the export directory and confirm both exports are well formed: REGDIR="<REGISTRY_DIR>" REG="$REGDIR/approved_identities.txt" CREG="$REGDIR/approved_client_identities.txt" mkdir -p "$REGDIR" missing="" [...

Verificar este host

Execute isto em uma máquina que você tenha permissão para auditar. A varredura é somente leitura.

tmaegis scan --target mcp-server