SW-MCP-009: Endpoint not served over HTTPS
Last updated 7 November 2026
| Fact | Value |
|---|---|
| Severity | High |
| Checks | MCP server |
| Malicious indicator | No |
| OWASP Agentic Top 10 | None mapped |
| OWASP MCP Top 10 | None mapped |
| NIST SP 800-53 | SC-7 (provisional mapping to SP 800-53 base controls) |
| First shipped in | Scanner 0.1.0 |
What it detects
This rule reads only the endpoint's address. The scanner takes the scheme and host from it, lowercases both and drops a default port and the path. The rule fires when no origin can be read, or when the scheme is not https. An address without a scheme, with an unclosed IPv6 bracket, with a port that is not a number or with a user name and password in front of the host cannot be read and is reported too.
A probe that was refused because the address was http records the error not_https and nothing else, so this is the only rule such a probe can trigger. The evidence is the address with any user name, password, query and fragment removed, and with a token in the path masked, so an address that carries a secret never reaches a report.
Why it matters
On a connection without transport encryption, anything on the network path can read the requests and answers. For an MCP server that includes the tool list, the arguments of each call and each result, and a party in the middle can rewrite a tool description before the agent reads it. The scanner maps this rule to NIST SP 800-53 control SC-7, Boundary Protection; no entry of the OWASP MCP Top 10 is about transport, so it carries none. Keys and bearer tokens travel in the same requests.
Example
This recorded probe shows an endpoint that starts with http://. The prober recorded the refusal not_https and made no request:
probe.json
{
"endpoint": "http://mcp.example.invalid/mcp",
"reachable": false,
"error": "not_https"
}A server check judges what a probe recorded, not files. The recorded probe above is read the way the scanner's README describes under Evaluating an MCP server probe.
How to fix
Serve the endpoint over https and update the address wherever it is registered. If the server cannot terminate TLS itself, put a proxy that you operate in front of it. The scanner does not send any probe to an http address, so the other MCP findings for this server appear only after the address is fixed.
If it is a false positive
A server on the same machine, reached on a loopback address during development, has no network path to protect. The scanner's own command never probes an http address (it reports SW-CFG-001 for the configuration entry instead), so this rule fires for an address that was registered with the hosted product. Accept it there with a note that says the address is local.
If the finding is not a problem in your case, accept it with a note: in the dashboard a manager or owner can accept a finding and the note is kept with it; with the scanner on its own, add it to the baseline file with a reason and an expiry date.