HTTP transport without auth

What mcp-scan saw

Two triggers. HIGH fires when server.url starts with http://. MEDIUM fires when any argument starts with http:// or https:// and is not covered by allowedDomains, and no env key contains the substring token or key. Both are marked fixable, with confidence 95 and 90 respectively.

Why it fires

The HIGH case is plaintext transport: request bodies, tool arguments, and any credential in a header cross the network readable. The MEDIUM case is the weaker signal, an endpoint with no visible credential, and the auth test is deliberately crude because a config can only show env key names, never whether a token is actually sent.

When this is a false positive

• There is no loopback exemption on the HIGH trigger. A url of http://localhost:3000 or http://127.0.0.1:8080 for a server running on the same machine reports as insecure transport at HIGH.
• The MEDIUM trigger fires on https:// arguments too, not just http://. An HTTPS endpoint whose credential is passed under an env key without the substring token or key, for example ANTHROPIC_API_SECRET or GH_PAT, reads as unauthenticated.
• Authentication that does not come from env at all, for example mTLS, a header file, or an OAuth flow the server runs itself, is invisible to the check by construction.

How to fix it

1. Run mcp-scan fix. For this rule it rewrites http:// to https:// in both args and url, handling both surfaces in the same pass.
2. Confirm the endpoint actually serves HTTPS before shipping that change, since the fix rewrites the string without probing the host.
3. For a genuine loopback server, add the host to allowedDomains in .mcp-scan.json. That clears the MEDIUM argument trigger; the HIGH url trigger has no allowlist path, so use suppressRules for that one.
4. If the credential is in env under a name the check cannot see, rename the key to include token or key, for example SERVICE_API_TOKEN.
5. To suppress, add 'http-transport-no-auth' to suppressRules in .mcp-scan.json.