SW-CFG-001: Remote MCP server over plain HTTP
Last updated 7 November 2026
| Fact | Value |
|---|---|
| Severity | High |
| Checks | Configuration file |
| Malicious indicator | No |
| OWASP Agentic Top 10 | None mapped |
| OWASP MCP Top 10 | None mapped |
| NIST SP 800-53 | SC-7 (provisional mapping to SP 800-53 base controls) |
| First shipped in | Scanner 0.3.0 |
What it detects
The rule reads every server of the MCP client files .mcp.json, .vscode/mcp.json and .cursor/mcp.json, and the servers of a local plugin. A server is judged whenever it has a url, whatever transport it declares, because an agent may connect to it. The address is read the way a browser reads it and the way curl reads it: leading spaces and control characters are stripped, tabs and line breaks removed, any run of slashes or backslashes accepted after the scheme, and a host taken from each reading. The rule fires when the scheme is http and either no host can be read or at least one host is not localhost, 127.0.0.1 or ::1.
One finding is raised per server, on the server's line. The evidence is the server name and the address with any user name or password in front of the host replaced by ***@, so a credential written into the address never reaches a report. An address that starts with https is not judged by this rule, and neither is an http address on one of the three loopback names.
Why it matters
A plain http connection can be read and changed by anything on the network path. For an MCP server that covers the tool list, the arguments of every call and every result, so a party in the middle can rewrite a tool description or a result that the agent then treats as coming from the server. Keys and bearer tokens sent in headers are readable on the wire too. The scanner maps this rule to NIST SP 800-53 control SC-7, Boundary Protection; no entry of the OWASP MCP Top 10 is about transport, so it carries none.
Example
This configuration points the server docs at a plain http address on a host that is not local:
.mcp.json
{
"mcpServers": {
"docs": {
"url": "http://docs.example.invalid/mcp"
}
}
}The finding sits on the line of the server, and its evidence shows the server name and the address.
How to fix
Change the address to https. If the server only offers http, put a proxy that you operate in front of it and let the proxy terminate the encrypted connection, or run the server on the same machine and use a localhost address.
In a connected run, the private registry check reports the same address with the reason insecure (see the registry check), so an address fixed here also clears that finding.
If it is a false positive
The rule exempts the three loopback names and nothing else. A name that only resolves inside a container network, such as http://mcp:8080/mcp, is still reported although the traffic never leaves the host. Accept it with a note that says where the name resolves, or use localhost with a published port.
If the finding is not a problem in your case, accept it with a note: in the dashboard a manager or owner can accept a finding and the note is kept with it; with the scanner on its own, add it to the baseline file with a reason and an expiry date.