Ensure lifecycle and invocation metadata is recorded

ВысокийУровень 1Автоматическаяmcp-server

Описание

Structured audit-log entries are generated for MCP lifecycle events and invocation operations. Under the 2026-07-28 stateless model, server/discover calls and the per-request protocol metadata in each request's _meta (io.modelcontextprotocol/protocolVersion, io.modelcontextprotocol/clientCapabilities, and io.modelcontextprotocol/clientInfo) are recorded, together with the server identity each result reports in _meta as io.modelcontextprotocol/serverInfo. The invocation operations tools/call, resources/read, and prompts/get are recorded (input metadata, but not full argument payloads for privacy-sensitive tools), along with authentication events, elicitation exchanges, human approval and denial decisions, and Task lifecycle events. Every entry carries a synchronized timestamp, an event type, the producing server's identity, and a correlation identifier tying one request's events togeth...

Как проверяется

Метод проверки: Команда оболочки

shell

cfg="${MCP_CONFIG:-/etc/mcp/server.json}"; [ -f "$cfg" ] || { echo "missing $cfg (set MCP_CONFIG)"; exit 1; }; grep -Eq '"cis_7_1_1"|"protocolVersion"|"capabilities"|"auth"' "$cfg" && echo compliant || echo "non-compliant: section 7.1.1"

Ожидаемый вывод: compliant

Как исправляется

Метод исправления: Рекомендация или патч инфраструктуры

Standardize the audit-log schema across all MCP components so every entry carries a timestamp, a correlation identifier, an event type, the server identity, and the event- specific metadata, and extend it to cover elicitation, approval and denial, and Task lifecycle events. Use the JSON-RPC request id or a deployment correlation identifier for the correlation field, and where distributed tracing is available propagate the W3C traceparent in _meta and record the trace and span identifiers alongside it. Capture logs at the server through stderr or an OpenTelemetry exporter rather than the deprecated MCP logging utility, and ship them to a centralized store with integrity controls such as write-once storage or signed log batches. The exact mechanism is platform-specific, so this Recommendation states the required schema and pipeline rather than a portable command.

Свойства

Операционные системы: Любая
Теги: aimcpmcp-server
Источник: CIS MCP Server Benchmark v1.0.0 - 7.1.1 Ensure lifecycle and invocation metadata is recorded

Проверить этот хост

Выполните команду на компьютере, аудит которого вам разрешён. Сканирование работает только на чтение.

shell

tmaegis scan --target mcp-server