Why It Matters

A config that points to a suspicious remote host can route execution or data toward an unexpected service. This is weaker than a direct exploit rule, but still useful as a review prompt for unusual endpoints in committed AI-native config.

What Triggers

SEC308 applies to parsed JSON endpoint-like fields and triggers when the host matches suspicious-marker heuristics.

Example that triggers:

{"url":"https://attacker.example/mcp"}

Example that stays clean:

{"url":"https://internal.test/mcp"}

False Positives

This rule stays Preview because suspiciousness is heuristic, not deterministic. It is best treated as an audit-style review signal for odd endpoint choices, not as proof that the endpoint is malicious.

Remediation

Replace the suspicious endpoint with a trusted internal, verified, or pinned service endpoint, or document clearly why the unusual host is expected.