Server reachable over plain HTTP
The MCP endpoint URL starts with http:// and is not a localhost dev server.
What it means
Any bearer token sent to this URL traverses the network in cleartext. Any attacker on-path (coffee shop WiFi, compromised router, hostile network middlebox) can read tokens and replay them. Localhost URLs (localhost, 127.0.0.1, [::1]) are exempted because dev servers legitimately run over plain HTTP.
How to fix
Serve the MCP endpoint over HTTPS only. On the HTTP port, respond with 301 redirect to the HTTPS equivalent, or close the connection. A .dev TLD is HSTS-preloaded in Chrome and Firefox and will refuse plain HTTP automatically.
Run the check against your own server:
npx -y @patchbay-nebius/agent audit <url-or-directory>No install: scan an MCP server in the browser and get a shareable report.
Disagree with this finding on your server? Open an issue with the --json output. False-positive reports are the most useful feedback.