Ensure MCP protocol version is pinned and logged

Kako se proverava

Metod provere: Komanda ljuske

cfg="${MCP_CONFIG:-/etc/mcp/server.json}"; [ -f "$cfg" ] || { echo "missing $cfg (set MCP_CONFIG)"; exit 1; }; grep -Eq '"cis_1_1"|"protocolVersion"|"capabilities"|"auth"' "$cfg" && echo compliant || echo "non-compliant: section 1.1"

Očekivani izlaz

compliant

Kako se ispravlja

Metod ispravke: Smernica ili zakrpa infrastrukture

Configure the deployment to reject any request that asserts a version outside the allowlist, omits it, or carries disagreeing header and body values, and to record the asserted version on every request. The version is asserted twice per Streamable HTTP POST, in the MCP-Protocol-Version header and in _meta under io.modelcontextprotocol/protocolVersion, and the two are required to match. The MCP server, or an L7 gateway able to inspect the body, rejects these in request-handling middleware: an out-of-allowlist version with -32022 (UnsupportedProtocolVersion), a header that disagrees with the body or a missing MCP-Protocol-Version header with -32020 (HeaderMismatch), and a request whose _meta omits the protocol version value with -32602 (Invalid params). All are rejected at HTTP 400. Record the asserted version, the request direction, and the client identity from _meta on every request, and ship the logs to the SIEM. The Audit reads the version from that _meta key, so a deployment that records it under a different name changes the Audit and this field together. Record the approved revision(s) in the enterprise MCP registry and export them to the newline-delimited allowlist the Audi...

Proverite ovaj računar

Pokrenite ovo na računaru za koji imate dozvolu za proveru. Skeniranje radi u režimu samo za čitanje.

tmaegis scan --target mcp-server