MCP-SEC-002

Endpoint is HTTPS with a valid, unexpired certificate chain

“All the OAuth protocol URLs (URLs exposed by the AS, RS and Client) MUST use the https scheme except for loopback interface redirect URIs, which MAY use the http scheme.” — spec anchor

How to fix this

House security rule, not a literal MCP spec requirement.

How the validator checks this

Probe P0, against a streamable-http server on the modern / legacy / dual protocol. What it reports:

pass: Endpoint is HTTPS and the TLS handshake succeeded
fail: Endpoint is plain HTTP, not HTTPS
skip: Could not connect to the endpoint (…), so its certificate was not assessed

Quoted from the probe that runs this check, so it cannot drift from what the validator actually reports.

This rule is checked deterministically: a fail here is a certain violation, not an inference.

How often this is violated

Of the 10 servers where this rule could be evaluated, 0 did not satisfy it.

Counted across public validation reports, one server counted once. Servers where the rule could not be checked are excluded from both figures — they say nothing either way.

Check your own server against MCP-SEC-002

Probe P0 checks MCP-SEC-002 in a request of its own, so one run shows your server's result for this rule next to the rest. Validate a server or read how the validator works.