SW-MCP-004: HTTP+SSE transport (deprecated)
Last updated 7 November 2026
| Fact | Value |
|---|---|
| Severity | Medium |
| Checks | MCP server |
| Malicious indicator | No |
| OWASP Agentic Top 10 | ASI04 |
| OWASP MCP Top 10 | None mapped |
| NIST SP 800-53 | SR-3 (provisional mapping to SP 800-53 base controls) |
| First shipped in | Scanner 0.1.0 |
What it detects
The probe records the status of its POST request, the content type of its GET request and whether the event stream began with an endpoint event. The rule fires when the POST was answered with 404 or 405, the GET answered with text/event-stream and the stream sent that endpoint event. Together these are the signature of the old two-address transport.
A server on streamable HTTP is classified the other way: its POST is answered with 200 and JSON or an event stream, and the rule does not fire. The evidence is POST 405, GET text/event-stream with an endpoint event with the status that was seen.
Why it matters
A deprecated transport is a dependency with an end date. Clients and gateways drop support for it, and a server that keeps it becomes harder to reach, to monitor and to patch consistently. The scanner maps this rule to OWASP ASI04, Agentic Supply Chain Vulnerabilities, and to NIST SP 800-53 control SR-3, Supply Chain Controls and Processes. The transport library a server depends on is part of what an agent relies on.
Example
This recorded probe shows a server whose POST was answered with 405 and whose GET returned an event stream that sent an endpoint event:
probe.json
{
"endpoint": "https://mcp.example.invalid/mcp",
"reachable": true,
"post_status": 405,
"get_content_type": "text/event-stream",
"sse_endpoint_event": true
}A server check judges what a probe recorded, not files. The recorded probe above is read the way the scanner's README describes under Evaluating an MCP server probe.
How to fix
Move the server to streamable HTTP, which answers POST requests on a single address. It is the first item of the migration checklist, which applies it when this rule matches.
If it is a false positive
A server that has to serve older clients may keep the transport next to streamable HTTP. The rule matches only when the POST request is refused with 404 or 405, so a server that answers POST requests normally is not reported. If your server is classified as SSE although it should accept POST, check what answers the POST address: a proxy in front of it may be refusing it.
If the finding is not a problem in your case, accept it with a note: in the dashboard a manager or owner can accept a finding and the note is kept with it; with the scanner on its own, add it to the baseline file with a reason and an expiry date.