Non-standard port

What mcp-scan saw

The scanner tested the serialized server config for an http, https, ws, or wss URL whose host is followed by a colon and four or five digits. Before reporting, it checks whether the whole config contains localhost: or 127.0.0.1: followed by digits anywhere, and suppresses the finding if so.

Why it fires

A high port is where things run that were never meant to face the network: a debug listener, a dev server, an admin panel. Corporate egress policy is usually written for 443 and 80, so a four or five digit port is both a signal that something unusual is being reached and a hint that whatever policy exists is being sidestepped.

When this is a false positive

• A self-hosted service you own on 8443 or 9000 behind TLS. The port number says nothing about the transport.
• The localhost suppression is checked against the entire config, not per URL. A config that mentions localhost:3000 anywhere silences this rule for every other high-port URL in the same server, so absence of the finding is not evidence.
• The regex accepts four digits, so ports from 1000 upward match even though the finding text describes them as above 1024.
• An SSE or streamable-HTTP MCP endpoint on a nonstandard port, which is a common self-hosting layout.

How to fix it

1. Read the config and find the URL with the high port. The finding text does not quote it, so you need the raw config.
2. Confirm the host and whether the connection is encrypted. A high port over https is fine; a high port over http is the insecure-transport finding, not this one.
3. Add the host to allowedDomains in .mcp-scan.json if it is yours. That does not clear this rule, which is port-based, but it clears the accompanying endpoint findings.
4. Move the service behind 443 where you control the deployment, which removes the finding and simplifies egress policy at the same time.
5. To suppress, add 'network-egress-non-standard-port' to suppressRules in .mcp-scan.json.