SW-CFG-004: MCP server at a raw IP address or behind a URL shortener
Last updated 7 November 2026
| Fact | Value |
|---|---|
| Severity | Medium |
| Checks | Configuration file |
| Malicious indicator | No |
| OWASP Agentic Top 10 | ASI10 |
| OWASP MCP Top 10 | None mapped |
| NIST SP 800-53 | SC-7 (provisional mapping to SP 800-53 base controls) |
| First shipped in | Scanner 0.3.0 |
What it detects
The rule reads every server with a url in the MCP client files, whatever its transport, and reads the address both the way a browser reads it and the way curl reads it, as SW-CFG-001 does. It fires for any scheme when a host is a raw IP address that is not a loopback address: IPv4 written in full, in the shortened or octal or hexadecimal forms that clients also accept, or IPv6. It also fires when a host, with a leading www. removed, is one of fifteen shorteners: bit.ly, tinyurl.com, t.co, goo.gl, is.gd, ow.ly, buff.ly, cutt.ly, rb.gy, tiny.cc, shorturl.at, rebrand.ly, t.ly, v.gd and s.id.
An address that has a scheme but no host under either reading is reported as well, with the evidence "unparseable host", because no one can be sure that every client reads it alike. The finding is on the server's line and shows the server name and the address with any user name and password replaced by ***@.
Why it matters
A bare IP address tells a reviewer nothing about who runs the server, and the machine behind it changes whenever the address is reassigned. A shortener hides the destination behind a redirect that its owner can point somewhere else after the file was reviewed. In both cases what the agent connects to is not something the file lets a person check. The scanner maps this rule to OWASP ASI10, Rogue Agents, and to NIST SP 800-53 control SC-7, Boundary Protection.
Example
The server below is reached by a bare IP address, taken from a range that is set aside for documentation examples:
.mcp.json
{
"mcpServers": {
"metrics": {
"type": "http",
"url": "https://203.0.113.10/mcp"
}
}
}The finding is on the server's line and its evidence is the server name and the address.
How to fix
Give the server a hostname that you control and that a reviewer can name, and serve it over https. For a server inside your own network, add a stable DNS name for it. Replace a shortened link with the address it expands to, after you have checked where it leads.
If it is a false positive
Addresses in the loopback range are exempt. A server on a private network that is reachable only by its address, such as a lab machine, is reported all the same. Accept the finding with a note that names the owner of the machine and the network it sits in.
If the finding is not a problem in your case, accept it with a note: in the dashboard a manager or owner can accept a finding and the note is kept with it; with the scanner on its own, add it to the baseline file with a reason and an expiry date.