MCP audit rule · v0.1.0
Remote server over plain HTTP
Traffic, including any auth headers, can be read or changed on the network.
- each server checks
- 2 test fixtures
high remote-http
Flagged
3 "r": {
4 > "url": "http://example.com/mcp"
5 }Fix
Use an https:// URL.
Fine
{
"mcpServers": {
"r": {
"url": "https://example.com/mcp"
}
}
}