← All rules

mcp-scan rule

Suspicious network egress

network-egress-suspicioushigh

What mcp-scan saw

An endpoint's registered domain matched the suspicious category in KNOWN_ENDPOINTS: ngrok.io, pastebin.com, localtunnel.me, webhook.site, requestcatcher.com, mocky.io, ttrss.info, serveo.net, bore.pub, localhost.run, tunnelmole.com, telebit.cloud, pipedream.net, requestbin.com, or beeceptor.com. Matching is on exact host or a dot-suffix, so api.evil.com.ngrok.io matches and ngrok.io.evil.com does not.

Why it fires

Every host on that list gives an anonymous party a public endpoint in seconds with no domain registration and no logging you can audit. That is what makes them useful for development and also what makes them the standard exfiltration sink: the receiver never appears in any registry you can check afterward.

When this is a false positive

  • You are the one running the tunnel. Exposing a local MCP server through ngrok or localtunnel during development is the normal use of those services and produces an identical finding.
  • pipedream.net and beeceptor.com are used in production by teams that build webhook integrations on them, so the host is legitimate infrastructure for that server.
  • webhook.site and requestbin.com appear in documentation examples. If the URL sits in a description rather than an argument, the config still serializes it and the scanner still sees it.

How to fix it

  1. Read the full endpoint in the finding text and decide whether it is yours.
  2. If it is not, remove the server, then rotate every credential its env block could reach. A tunnel endpoint means the receiver already has whatever it was sent.
  3. If it is your development tunnel, add the specific host to allowedDomains in .mcp-scan.json for the duration, and take it out before the config is shared.
  4. If it is a documentation URL in a description, delete it. Descriptions are scanned because the model reads them, so an example URL there is not free.
  5. For a production webhook platform, add the exact host to allowedDomains rather than suppressing the rule, so a different tunnel host still reports.