Ensure MCP Apps permission requests default-deny, all app-to-host messages are logged, and high-risk channels are consented

Nasıl denetlenir

Denetim yöntemi: Manuel inceleme

Bu öneri otomatik olarak denetlenemez. --include-manual parametresini verdiğinizde tarama bunu bu talimatlarla birlikte listeler.

Confirm by host configuration review that requested permissions are default-deny and granted only on a recorded user decision, that all app-to-host messages are logged with attribution, and that the two high-risk channels are consented. Attempt an app tools/call for a tool whose declared visibility does not include "app" and confirm the host rejects it, and confirm a tool whose visibility excludes "model" does not appear in the agent's tool list. Run the following command: LOG="<HOST_APP_LOG>" command -v jq >/dev/null 2>&1 || { echo "ERROR: jq is required and not installed (cannot verify)"; exit 0; } [ -s "$LOG" ] || { echo "ERROR: host application log <HOST_APP_LOG> not found or empty (cannot verify)"; exit 0; } events=$(grep -E '"event":"app_permission"|"event":"app_message"' "$LOG") n=$(printf '%s\n' "$events" | grep -c .) [ "$n" -gt 0 ] || { echo "REVIEW: no MCP Apps permission or message events found (extension may not be in use)"; exit 0; } printf '%s\n' "$events" | jq -e . >/dev/null 2>&1 || { echo "ERROR: records are not parseable (cannot verify)"; exit 0; } echo "count: $n app permission/message events in window" autogrant=$(printf '%s\n' "$events" | jq -c 'select(.even...

Nasıl düzeltilir

Düzeltme yöntemi: Kılavuz veya altyapı yaması

These are host configuration and host implementation settings, with no portable command. Configure the host to deny all four MCP Apps permissions by default and to grant one only on an explicit per-permission user decision recorded with a user decision source, never automatically from the resource's request. Log every app-to-host message with the requesting server identity, and gate the two high-risk channels, ui/message and ui/update-model-context, behind an explicit user consent decision recorded with a user decision source. Enforce the _meta.ui.visibility declaration so that an app cannot call a tool whose visibility omits "app", and the agent's tool list omits any tool whose visibility omits "model".