Insecure MCP server transport
ID |
mcp_server_hardening |
Severity |
high |
Remediation Complexity |
trivial |
Remediation Risk |
low |
Remediation Effort |
low |
Family |
SCM |
Tags |
ai-security, cicd-security, non-reachable, security, spvs15-v3.5.3, supply-chain |
Description
Model Context Protocol (MCP) servers extend AI coding agents with tools, data and remote endpoints. When an agent connects to a remote MCP server, that connection must be secure and authenticated (SPVS v1.5-AI V3.5.3).
This detector flags a remote MCP server configured with an insecure plaintext http:// URL to a non-local host, read from the same configuration files as mcp_server_inventory (.mcp.json, .cursor/mcp.json, .vscode/mcp.json, .claude/settings.json). Over plaintext, the connection and any bearer token are exposed in transit — so even an authenticated connection is not secure.
To avoid false positives, the detector reports only remote http:// URLs to non-local hosts. https:// servers, local/loopback/private-range hosts (localhost, 127.0.0.1, ::1, *.local, 10./192.168./172.16-31./169.254.x) and stdio (local command) servers are not reported. It does not attempt to judge whether a server is authenticated — MCP OAuth is negotiated at runtime and is not present in the config, so flagging its absence would be a false positive. Hardcoded credentials in the config are covered by secret scanning, and the approved-allowlist requirement (V3.5.2) is org policy not present in the repository; both are surfaced in the remediation guidance rather than asserted here.
|
Security
An MCP connection carries the agent’s credential and its full tool/data traffic. Over http:// this is exposed to network eavesdropping and tampering (a man-in-the-middle can steal the token or inject responses that steer the agent). Requiring TLS for every remote MCP server is the transport-security precondition for the rest of the V3.5 controls (authentication, allowlisting, manifest integrity).