Outdated transport

What mcp-scan saw

The transport scanner tested whether the args array contains the exact string --transport=sse. It is an exact array membership check, so --transport sse as two arguments or -t=sse does not match. The finding is marked fixable with confidence 80.

Why it fires

SSE is the deprecated MCP transport, superseded by streamable-http. Deprecated transports stop receiving fixes before they stop working, so the window between deprecation and breakage is when the change is cheap. It is LOW because nothing is broken yet.

When this is a false positive

• Your MCP client only speaks SSE. Client support lags the specification, and switching the server ahead of the client breaks the connection.
• The server itself has no streamable-http implementation, so the flag is the only transport it offers.
• The exact-match check means a config using a different flag spelling for the same transport does not report, so absence of this finding is not evidence that SSE is not in use.

How to fix it

1. Run mcp-scan fix. For this rule it rewrites --transport=sse to --transport=streamable-http in the args array.
2. Confirm both the server and the client support streamable-http before applying it, since the fix rewrites the string without probing either.
3. If the client is the constraint, leave it and re-check after the client's next release.
4. If the server is the constraint, check its changelog for streamable-http support, or plan the move to a maintained alternative.
5. To suppress, add 'outdated-transport' to suppressRules in .mcp-scan.json.