Skill Crossroads

Check reference / Safety & Security

MCP-03 Remote transports use TLS

Safety & Security · 15% of the grade · deterministic · applies to MCP configs

Deterministic — runs on every scan, no LLM or network needed.

Why it matters

A plain http:// transport sends every tool call — arguments, results, and any tokens in headers — across the network unencrypted, readable and modifiable by anyone on the path. Loopback (localhost / 127.0.0.1) is exempt because that traffic never leaves the machine.

How to fix it

Change the server `url` to https://. Only localhost/127.0.0.1 may stay on plain HTTP.

Example

✗ flagged
"url": "http://mcp.example.com/sse"
✓ passes
"url": "https://mcp.example.com/sse"