MCP-SEC-004

icons[].src is https: or data:, same-origin, no unsafe scheme

“Ensure that the icon URI is either a HTTPS or data: URI. Clients MUST reject icon URIs that use unsafe schemes and redirects... Verify that icon URIs are from the same origin as the server.” — spec anchor

How to fix this

Serve icon URIs over `https:` or inline as `data:`, from the same origin as the server. A conformant client rejects any other scheme, and follows no redirects to reach one.

Example: failing and passing

The tool's icon is served from a different origin than the MCP server, which clients are told to verify against.

Violates MCP-SEC-004 · JSON

{
  "name": "search",
  "inputSchema": { "type": "object" },
  "icons": [
    {
      "src": "https://cdn.example.net/icons/search.png",
      "mimeType": "image/png",
      "sizes": ["48x48"]
    }
  ]
}

The icon URI uses https: on the MCP server's own origin.

Complies with MCP-SEC-004 · JSON

{
  "name": "search",
  "inputSchema": { "type": "object" },
  "icons": [
    {
      "src": "https://mcp.example.com/icons/search.png",
      "mimeType": "image/png",
      "sizes": ["48x48"]
    }
  ]
}

How the validator checks this

Probe P2.1, against a streamable-http server on the modern protocol. What it reports:

pass: All … advertised icon URI… use https: or data: and are same-origin with the server
fail: Icon URIs a conformant client must reject — …${problems.length > 3 ?
skip: This server advertises no icons, so there is no icon URI to check

Quoted from the probe that runs this check, so it cannot drift from what the validator actually reports.

This rule is checked deterministically: a fail here is a certain violation, not an inference.

Checked in the same request as MCP-HDR-008, MCP-HDR-009, MCP-RES-003, MCP-RES-006, MCP-RES-007, MCP-ERR-003, MCP-ERR-004, MCP-ERR-005, MCP-ERR-008, MCP-CAC-001, MCP-CAC-002, MCP-CAC-003, MCP-CAC-004, MCP-CAC-005, MCP-SCH-001, MCP-SCH-002, MCP-SCH-003, MCP-SCH-004, MCP-SCH-005, MCP-SCH-006, MCP-SCH-007, MCP-SEC-005, MCP-SEC-006, MCP-DEP-005.

Check your own server against MCP-SEC-004

Probe P2.1 checks MCP-SEC-004 in the same request as 24 other rules, so one run shows your server's result for this rule next to the rest. Validate a server or read how the validator works.