Ensure third-party MCP servers are pinned to a verified content hash and re-vetted before updates

Como é verificado

Método de auditoria: Revisão manual

Esta recomendação não pode ser verificada automaticamente. Uma varredura a lista com estas instruções quando você passa --include-manual.

Verify that every recorded artifact matches its approved SHA-256, and that every installed server instance under the servers root maps to an approved hash for its identity. The approved-hash file has one line per pinned artifact in the form <sha256> <identity> <artifact_path>. One identity may carry more than one approved hash if it legitimately runs more than one build. The instance scan takes identities from each server.json name and each package.json mcpName, and hashes each instance's own entry artifact. This block requires bash. Run the following command with MCP_SERVERS_ROOT set to the directory of installed servers: APPROVED="<APPROVED_HASHES_FILE>" SERVERS_ROOT="<MCP_SERVERS_ROOT>" if [ ! -r "$APPROVED" ]; then echo "ERROR: approved-hash list not readable at the configured path, cannot verify any server" exit 0 fi command -v sha256sum >/dev/null 2>&1 || { echo "ERROR: sha256sum unavailable, cannot verify artifact hashes"; exit 0; } norm() { printf '%s' "$1" | tr -d '\r' | sed 's/\xc2\xa0//g'; } declare -A approved_for rec_h=(); rec_id=(); rec_art=(); checked=0 while IFS= read -r raw || [ -n "$raw" ]; do line=$(printf '%s' "$raw" | tr -d '\r' | sed 's/\xc2\xa0/ /g') case...

Como é corrigido

Método de correção: Orientação ou patch de infraestrutura

Record the SHA-256 hash of each approved third-party server artifact, including its dependency bundle, in the capability baseline, keyed to the server's server.json name. Take the value from a native SHA-256 pin where one exists (mcpb fileSha256, or an oci reference that uses a sha256: digest). Otherwise compute a SHA-256 over the approved artifact by a documented procedure. Package-registry integrity, such as an npm, pypi, or nuget feeds, is a separate install-time check and is not the recorded value, and only the channels the deployment installs from need to be covered. Configure the host or gateway to refuse to start any server whose recomputed artifact hash does not match the value recorded for its identity, and to refuse any installed server with no recorded approved hash. Implement a re-vetting workflow, equivalent to initial onboarding, triggered by a hash mismatch or an update notification. This is host, gateway, and process configuration, and the blocking enforcement is implementation-specific.