Ensure server capability baseline is established and documented

Как проверяется

Метод проверки: Ручная проверка

Эту рекомендацию нельзя проверить автоматически. Сканирование выводит её вместе с этими инструкциями при указании флага --include-manual.

Compare the full capability configuration the server advertises through server/discover against the approved baseline, and flag any deviation as drift. The comparison covers every nested setting, not only the names, so a change to a value such as tools.listChanged or an extension setting is drift even though no name changed. Maintain the baseline per server as the canonical JSON capability object, for example <BASELINE_DIR>/<SERVER>.capabilities.json. Run the following script to retrieve the advertised configuration and compare it against the baseline: MCP_URL="https://<SERVER_URL>/mcp" BASELINE="<BASELINE_DIR>/<SERVER>.capabilities.json" LEAF='(paths(type | IN("string","number","boolean","null")), paths(type == "object" and length == 0), paths(type == "array" and length == 0)) as $p | ($p | tojson) + "\t" + (getpath($p) | tojson)' resp=$(curl -sS --connect-timeout 5 --max-time 20 -X POST "$MCP_URL" \ -H 'Content-Type: application/json' \ -H 'Accept: application/json, text/event-stream' \ -H 'MCP-Protocol-Version: 2026-07-28' \ -H 'Mcp-Method: server/discover' \ -d '{"jsonrpc":"2.0","id":1,"method":"server/discover","params":{"_meta":{"io.modelconte xtprotocol/protocolVersion":"...

Как исправляется

Метод исправления: Рекомендация или патч инфраструктуры

Establish the baseline from a server in a known-good state, have it reviewed, and store it in the enterprise registry under change control. Run the following script to capture the baseline as the canonical JSON capability object. Capturing from a drifted server writes the drift into the baseline, so capture only from a server in its approved state. The script leaves any existing baseline untouched if the configuration cannot be retrieved or the server advertises an empty set: MCP_URL="https://<SERVER_URL>/mcp" BASELINE="<BASELINE_DIR>/<SERVER>.capabilities.json" mkdir -p "$(dirname "$BASELINE")" LEAF='(paths(type | IN("string","number","boolean","null")), paths(type == "object" and length == 0), paths(type == "array" and length == 0)) as $p | $p | tojson' resp=$(curl -sS --connect-timeout 5 --max-time 20 -X POST "$MCP_URL" \ -H 'Content-Type: application/json' \ -H 'Accept: application/json, text/event-stream' \ -H 'MCP-Protocol-Version: 2026-07-28' \ -H 'Mcp-Method: server/discover' \ -d '{"jsonrpc":"2.0","id":1,"method":"server/discover","params":{"_meta":{"io.modelconte xtprotocol/protocolVersion":"2026-07- 28","io.modelcontextprotocol/clientInfo":{"name":"cis-benchmark- audi...