MCP-005 Cleartext or unauthenticated remote endpoint

A remote MCP server (the url form, not command) carries every prompt, tool call and result over the network. Over http://, anyone on the path sees the whole conversation and any credentials. Over https:// with no auth declared, the server may answer any caller.

What Vulkro detects

Shape	Condition	Severity	Confidence	Signal
Cleartext	URL starts with `http://` and is not loopback (`localhost`, `127.0.0.1`, `[::1]`). Fires even with auth, since the credential also travels in cleartext.	`High`	`High`	`mcp-server-cleartext-http`, weight `0.7`, `Pattern`
Unauthenticated HTTPS	URL starts with `https://` and no auth indicator: no env key matching `Authorization`, `Bearer`, `Token`, `API_KEY`, `<X>_API_KEY`, `<X>_TOKEN`, `secret`; no arg matching `Authorization:`, `Bearer` , `--api-key`, `--token`, `--auth`.	`Medium`	`Medium`	`mcp-server-unauthenticated-https`, weight `0.5`, `Heuristic`

The second shape is a heuristic and can miss an unusual auth form.

Non-compliant code

The first entry sends prompts in cleartext; the second declares no auth.

{
  "mcpServers": {
    "remote-tool": { "type": "http", "url": "http://mcp.example.com/v1" },
    "open-listener": { "type": "http", "url": "https://mcp.example.com/v1" }
  }
}

Compliant code

{
  "mcpServers": {
    "remote-tool": {
      "type": "http",
      "url": "https://mcp.example.com/v1",
      "env": { "Authorization": "Bearer ${MCP_TOKEN}" }
    }
  }
}

How to fix

Switch to https://. If the upstream only speaks HTTP, put TLS in front of it (a reverse proxy or an SSH tunnel).
Add an auth indicator: an Authorization: Bearer ${TOKEN} env entry, an API_KEY env var, or an --api-key / --auth argument.
If the upstream is truly public, document that trust assumption.
For local development use http://localhost:<port>, which is exempt.

What Vulkro detects​

Non-compliant code​

Compliant code​

How to fix​

References​

What Vulkro detects

Non-compliant code

Compliant code

How to fix

References