TMA-MCP-7.1.1

Ensure lifecycle and invocation metadata is recorded

YüksekDüzey 1Otomatikmcp-server

Açıklama

Structured audit-log entries are generated for MCP lifecycle events and invocation operations. Under the 2026-07-28 stateless model, server/discover calls and the per-request protocol metadata in each request's _meta (io.modelcontextprotocol/protocolVersion, io.modelcontextprotocol/clientCapabilities, and io.modelcontextprotocol/clientInfo) are recorded, together with the server identity each result reports in _meta as io.modelcontextprotocol/serverInfo. The invocation operations tools/call, resources/read, and prompts/get are recorded (input metadata, but not full argument payloads for privacy-sensitive tools), along with authentication events, elicitation exchanges, human approval and denial decisions, and Task lifecycle events. Every entry carries a synchronized timestamp, an event type, the producing server's identity, and a correlation identifier tying one request's events togeth...

Nasıl denetlenir

Denetim yöntemi: Kabuk komutu

shell

cfg="${MCP_CONFIG:-/etc/mcp/server.json}"; [ -f "$cfg" ] || { echo "missing $cfg (set MCP_CONFIG)"; exit 1; }; grep -Eq '"cis_7_1_1"|"protocolVersion"|"capabilities"|"auth"' "$cfg" && echo compliant || echo "non-compliant: section 7.1.1"

Beklenen çıktı: compliant

Nasıl düzeltilir

Düzeltme yöntemi: Kılavuz veya altyapı yaması

Standardize the audit-log schema across all MCP components so every entry carries a timestamp, a correlation identifier, an event type, the server identity, and the event- specific metadata, and extend it to cover elicitation, approval and denial, and Task lifecycle events. Use the JSON-RPC request id or a deployment correlation identifier for the correlation field, and where distributed tracing is available propagate the W3C traceparent in _meta and record the trace and span identifiers alongside it. Capture logs at the server through stderr or an OpenTelemetry exporter rather than the deprecated MCP logging utility, and ship them to a centralized store with integrity controls such as write-once storage or signed log batches. The exact mechanism is platform-specific, so this Recommendation states the required schema and pipeline rather than a portable command.

Özellikler

İşletim sistemleri: Herhangi biri
Etiketler: aimcpmcp-server
Referans: CIS MCP Server Benchmark v1.0.0 - 7.1.1 Ensure lifecycle and invocation metadata is recorded

Bu ana makineyi denetle

Bunu denetleme izniniz olan bir makinede çalıştırın. Tarama salt okunurdur.

shell

tmaegis scan --target mcp-server