Encryption gap

What mcp-scan saw

This runs only after data-controls-pii fired. The scanner then lowercased the full serialized server config and searched it for any of encrypt, aes, kms, crypto, vault, sealed, or 'at rest'. When none appear, it pushes this finding. The search is plain substring matching over the whole JSON, so env var names count as evidence.

Why it fires

It is the only encryption signal available from a config file. The scanner never connects to the server, so it cannot observe storage, and it treats the absence of any encryption vocabulary in the config as the absence of a documented control. It is graded HIGH because it is the one gap in the data-controls family where the failure is silent: unencrypted storage looks identical to encrypted storage until the disk is read.

When this is a false positive

• The server stores nothing. A stateless proxy that forwards requests has no data at rest to encrypt, but it still trips the gate rule through a description keyword and then fails this check by definition.
• Encryption is handled a layer down, by FileVault, by an encrypted volume, or by the managed database the server connects to. None of those put the word encrypt in the client config.
• The substring search means 'crypto' in a cryptocurrency server's name suppresses this finding for entirely unrelated reasons, which is the same mechanism working in reverse.

How to fix it

1. First confirm the gate rule was right: read the data-controls-pii finding and check whether the server actually holds personal data.
2. If it holds nothing, this finding is not actionable. Fix the gate rule instead by removing the keyword that triggered it.
3. If it does store data, encrypt it at rest with AES-256 or the platform key store, and name the mechanism in the server config so the check has something to find.
4. Adding an env var such as DB_ENCRYPT_KEY or STORAGE_KMS_KEY_ID satisfies the substring search and is also the honest way to wire the key in.
5. To suppress the whole family for one server, add its config key to .mcp-scan-ignore, which downgrades every finding for that server to INFO.