Ensure lifecycle and invocation metadata is recorded

ВисокаНиво 1Аутоматскаmcp-server

Опис

Structured audit-log entries are generated for MCP lifecycle events and invocation operations. Under the 2026-07-28 stateless model, server/discover calls and the per-request protocol metadata in each request's _meta (io.modelcontextprotocol/protocolVersion, io.modelcontextprotocol/clientCapabilities, and io.modelcontextprotocol/clientInfo) are recorded, together with the server identity each result reports in _meta as io.modelcontextprotocol/serverInfo. The invocation operations tools/call, resources/read, and prompts/get are recorded (input metadata, but not full argument payloads for privacy-sensitive tools), along with authentication events, elicitation exchanges, human approval and denial decisions, and Task lifecycle events. Every entry carries a synchronized timestamp, an event type, the producing server's identity, and a correlation identifier tying one request's events togeth...

Како се проверава

Метод провере: Команда љуске

shell

cfg="${MCP_CONFIG:-/etc/mcp/server.json}"; [ -f "$cfg" ] || { echo "missing $cfg (set MCP_CONFIG)"; exit 1; }; grep -Eq '"cis_7_1_1"|"protocolVersion"|"capabilities"|"auth"' "$cfg" && echo compliant || echo "non-compliant: section 7.1.1"

Очекивани излаз: compliant

Како се исправља

Метод исправке: Смерница или закрпа инфраструктуре

Standardize the audit-log schema across all MCP components so every entry carries a timestamp, a correlation identifier, an event type, the server identity, and the event- specific metadata, and extend it to cover elicitation, approval and denial, and Task lifecycle events. Use the JSON-RPC request id or a deployment correlation identifier for the correlation field, and where distributed tracing is available propagate the W3C traceparent in _meta and record the trace and span identifiers alongside it. Capture logs at the server through stderr or an OpenTelemetry exporter rather than the deprecated MCP logging utility, and ship them to a centralized store with integrity controls such as write-once storage or signed log batches. The exact mechanism is platform-specific, so this Recommendation states the required schema and pipeline rather than a portable command.

Својства

Оперативни системи: Било који
Ознаке: aimcpmcp-server
Референца: CIS MCP Server Benchmark v1.0.0 - 7.1.1 Ensure lifecycle and invocation metadata is recorded

Проверите овај рачунар

Покрените ово на рачунару за који имате дозволу за проверу. Скенирање ради у режиму само за читање.

shell

tmaegis scan --target mcp-server