Why It Matters

server.json remotes are intended to describe public registry endpoints. Insecure HTTP or non-public host literals weaken transport trust or leak private topology into published registry metadata.

What Triggers

SEC319 applies to server.json remotes[] entries and triggers when a remote URL is:

• explicitly http://, or
• a non-public host literal in the registry remote entry

It does not inspect package transport URLs.

Example that triggers:

{
  "remotes": [
    {
      "type": "streamable-http",
      "url": "http://example.com/mcp"
    }
  ]
}

Example that stays clean:

{
  "packages": [
    {
      "transport": {
        "type": "streamable-http",
        "url": "http://localhost:8080/mcp"
      }
    }
  ]
}

False Positives

This rule is intentionally scoped to registry remotes[] entries, not all URL fields in the document. That avoids flagging local package transport details that are outside the public remote surface.

Remediation

Use a public HTTPS remote URL in the registry entry or remove the non-public literal from the remote definition.