MCP-SEC-002

Endpoint is HTTPS with a valid, unexpired certificate chain

“All the OAuth protocol URLs (URLs exposed by the AS, RS and Client) MUST use the https scheme except for loopback interface redirect URIs, which MAY use the http scheme.” — spec anchor

How to fix this

House security rule, not a literal MCP spec requirement.

How the validator checks this

Probe P0, against a streamable-http server on the modern / legacy / dual protocol. What it reports:

pass: Endpoint is HTTPS and the TLS handshake succeeded
fail: Endpoint is plain HTTP, not HTTPS

Quoted from the probe that runs this check, so it cannot drift from what the validator actually reports.

This rule is checked deterministically: a fail here is a certain violation, not an inference.

How often this is violated

Of the 7 servers where this rule could be evaluated, 0 did not satisfy it.

Counted across public validation reports, one server counted once. Servers where the rule could not be checked are excluded from both figures — they say nothing either way.

Check your own server against this rule

The validator makes real protocol requests and reports this rule as pass, warn or fail alongside the other 78. Validate a server or read how the check works.