AG-012: Unencrypted MCP Transport

What this rule means

An MCP server is reached over plaintext (an http:// URL rather than https://). Tool descriptions, arguments and results — which routinely carry credentials and private data — cross the network unprotected.

Why it matters

Tool descriptions are instructions to the model, so anyone who can rewrite them in transit can steer the agent; this is the network-level form of tool poisoning.

How to fix it

Use https:// for every remote MCP server; keep stdio transports local rather than exposing them over a network.

Detect it

pip install lucin
lucin scan .                  # all rules
lucin explain AG-012          # this rule, in your terminal

Findings carry a file:line and, where the rule supports it, a witness path showing the flow that triggered it. Precision and recall for the whole rule set, with the commands that regenerate them, are on the benchmarks page — and the gaps are on limits.

← All detection rules