Skip to main content
Data transmitted in plaintext without HTTPS/TLS.

​
How to resolve

  • Require TLS in requests to the MCP server: Configure the MCP server to require HTTPS/TLS for all client connections and reject plaintext HTTP requests. Configure the server to use TLS 1.2 or higher with strong cipher suites, disabling older protocols like TLS 1.0/1.1 and SSL. Enable HTTP Strict Transport Security (HSTS) headers to prevent protocol downgrade attacks.
  • Use mTLS if possible for bidirectional authentication: For internal deployments, consider using mutual TLS (mTLS) for bidirectional authentication.
  • Perform certificate validation: Ensure proper certificate validation is enabled on the client side to prevent man-in-the-middle attacks.
  • Automated certificate renewal processes: Regularly monitor certificate expiration dates and implement automated renewal processes.

​
Risk

Governance/Compliance Lack of TLS vulnerabilities violate multiple security standards:
  • NIST SP 800-52 Rev. 2 (Guidelines for TLS Implementations): Fails to follow TLS implementation guidelines that mandate encrypted communications for systems handling sensitive data.
  • OWASP MCP Top 10 (MCP01:2025 - Token Mismanagement & Secret Exposure): Exposes authentication tokens and secrets to interception by transmitting them over unencrypted connections.
Security Without TLS encryption, all communication between MCP clients and servers is vulnerable to eavesdropping, man-in-the-middle attacks, and data interception. Attackers on the network path can capture authentication tokens, API keys, sensitive parameters passed to tools, and confidential data returned by the server. This exposure enables credential theft, session hijacking, and unauthorized access to protected resources. Additionally, lack of TLS removes integrity protection, allowing attackers to modify requests and responses in transit, potentially leading to data corruption or injection of malicious commands. The risk is heightened when MCP servers operate over untrusted networks such as public Wi-Fi.

​
Explanation

Data transmitted between MCP clients and servers is sent in plaintext without HTTPS/TLS encryption. Unencrypted communications expose potentially sensitive information including authentication credentials, API keys, tool parameters, and response data to interception by attackers on the network. This is especially critical for MCP servers as they often handle privileged operations and sensitive data on behalf of LLM applications.

​
Specifications

Trigger
  • MCP server scan detects that the server does not enforce HTTPS/TLS for client-server communications or accepts plaintext HTTP connections.
Severity
  • HIGH
Applies to: MCP Server