Ensure tool schemas and argument types are validated

Como é verificado

Método de auditoria: Comando shell

cfg="${MCP_CONFIG:-/etc/mcp/server.json}"; [ -f "$cfg" ] || { echo "missing $cfg (set MCP_CONFIG)"; exit 1; }; grep -Eq '"cis_5_1_1"|"protocolVersion"|"capabilities"|"auth"' "$cfg" && echo compliant || echo "non-compliant: section 5.1.1"

Saída esperada

compliant

Como é corrigido

Método de correção: Orientação ou patch de infraestrutura

Add a validation middleware layer that runs before tool dispatch and validates every tool call's arguments against the tool's input schema under the dialect the schema declares. Return a schema-violating call as a tool execution error in a normal result with isError set true, and reject a structurally malformed tools/call request as a protocol error. Where a tool declares an outputSchema, validate the structured result against it before returning. Sanitize all schema fields, meaning tool names, parameter names, descriptions, and outputs, not only inputSchema, before they reach the model or downstream use. Tighten schemas to strict types, disallow additionalProperties where appropriate, and mark required fields. Configure the validator so it does not auto- dereference external $ref URIs, and bound schema depth and validation time. This is server middleware and configuration, and the exact validator is implementation-specific, for example ajv for TypeScript servers, so there is no portable command.

Verificar este host

Execute isto em uma máquina que você tenha permissão para auditar. A varredura é somente leitura.

tmaegis scan --target mcp-server