cfgaudit

Rules / CFG058

CFG058 MCP server uses the deprecated sse transport

Severity: warn OWASP: LLM02:2026 – Sensitive Information Disclosure OWASP MCP: MCP01:2025 – Token Mismanagement & Secret Exposure — provisional (MCP Top 10 v0.1)

What cfgaudit checks

A remote MCP server declares its transport with a type field. The MCP specification has superseded the standalone HTTP+SSE transport with Streamable HTTP (type: "http"). The legacy type: "sse" transport carries weaker properties: a long-lived, unidirectional event stream without resumability, and the DNS-rebinding / Origin-and-Host validation pitfalls that affect HTTP-based MCP servers. OWASP AISVS C10.3.1/C10.3.2 restrict SSE to local or tightly-controlled channels for exactly this reason.

cfgaudit flags any MCP server declared with type: "sse" (case-insensitive), across every MCP source it discovers (settings.json mcpServers, .mcp.json, and other agents' configs). The finding is attributed to the file the server was declared in.

Relationship to CFG049

CFG049 keys on the url (cleartext scheme / non-loopback host / raw IP) and is transport-agnostic. CFG058 keys on the transport choice itself, so it fires even for a TLS or loopback SSE server that CFG049 leaves at warn or does not flag. A remote, cleartext SSE server legitimately trips both rules, for different reasons.

Trigger example

{
  "mcpServers": {
    "partner": { "type": "sse", "url": "https://mcp.partner.example/sse" }
  }
}

→ warn (deprecated transport). A loopback SSE server is also flagged, but is the lower-risk case the safe alternative keeps.

Safe alternative

Switch to Streamable HTTP (type: "http"):

{ "mcpServers": { "partner": { "type": "http", "url": "https://mcp.partner.example/mcp" } } }

If an SSE server must remain (e.g. a legacy bridge), keep it on a loopback / tightly-controlled channel and enforce Origin/Host validation upstream.

References

Documentation for cfgaudit 1.18.1. Source of this page · Rule implementation