MCP-SEC-005
No $ref in tool schemas resolves to a network URI
“Implementations MUST NOT automatically dereference $ref values that resolve to a network URI.” — spec anchor
How to fix this
Keep `$ref` values local, such as `#/$defs/Thing`. A `$ref` pointing at a network URI must never be automatically dereferenced, so a schema that depends on one will not resolve.
How the validator checks this
Probe P2.1, against a streamable-http server on the modern protocol. What it reports:
- pass
- No $ref in … advertised schema… resolves to a network URI
- fail
- Schema contains … $ref pointing at a network URI, which an implementation MUST NOT dereference
Quoted from the probe that runs this check, so it cannot drift from what the validator actually reports.
This rule is checked deterministically: a fail here is a certain violation, not an inference.
Checked in the same request as MCP-HDR-008, MCP-HDR-009, MCP-RES-003, MCP-RES-006, MCP-RES-007, MCP-ERR-003, MCP-ERR-004, MCP-ERR-005, MCP-ERR-008, MCP-CAC-001, MCP-CAC-002, MCP-CAC-003, MCP-CAC-004, MCP-CAC-005, MCP-SCH-001, MCP-SCH-002, MCP-SCH-003, MCP-SCH-004, MCP-SCH-005, MCP-SCH-006, MCP-SCH-007, MCP-SEC-004, MCP-SEC-006, MCP-DEP-005.
Check your own server against this rule
The validator makes real protocol requests and reports this rule as pass, warn or fail alongside the other 78. Validate a server or read how the check works.
Other Security posture rules
- MCP-SEC-001Invalid Origin header returns HTTP 403
- MCP-SEC-002Endpoint is HTTPS with a valid, unexpired certificate chain
- MCP-SEC-003Error messages do not echo request headers or credentials
- MCP-SEC-004icons[].src is https: or data:, same-origin, no unsafe scheme
- MCP-SEC-006Schema depth and subschema count stay within safe bounds
- MCP-SEC-007Server does not reflect the Authorization header into responses