Rules / CFG075

CFG075 MCP server disables TLS certificate verification (MITM kill switch)

Severity: error OWASP: LLM02:2026 – Sensitive Information Disclosure OWASP MCP: MCP01:2025 – Token Mismanagement & Secret Exposure — provisional (MCP Top 10 v0.1)

What cfgaudit checks

An MCP server launched with TLS certificate verification turned off silently accepts MITM'd TLS connections to its upstream. The endpoint can be https://, but if the process trusts any certificate, an on-path attacker reads and rewrites the traffic — including the agent's context and any forwarded credentials. This defeats the remote-URL / cleartext hardening cfgaudit already enforces (CFG049 remote URL, CFG021 proxy, CFG068 templated cred to cleartext, CFG069 log redaction).

cfgaudit flags an MCP server (in settings.json mcpServers, .mcp.json, or any cross-agent equivalent) whose env or args disables certificate verification. These are deterministic literal key/value (or arg) patterns in a committable config.

`env` kill switches

Key	Disabling value
`NODE_TLS_REJECT_UNAUTHORIZED`	`0`
`PYTHONHTTPSVERIFY`	`0`
`GIT_SSL_NO_VERIFY`	`1`/`true`
`SSL_VERIFY`, `VERIFY_SSL`, `_SSL_VERIFY`, `_TLS_VERIFY`	`false`/`0`
`NPM_CONFIG_STRICT_SSL`	`false`
`PGSSLMODE`	`disable`
`REQUESTS_CA_BUNDLE`, `CURL_CA_BUNDLE`	empty / `/dev/null`
any value containing `sslmode=disable` (DB connection string to a non-loopback host)	—

`args` kill switches

Token	Tool
`--insecure`	curl / httpie / generic
`--no-check-certificate`	wget
`-k`	only when the server `command` is `curl`/`wget` (ambiguous otherwise)

A templated / ${VAR} / $(…) value is not flagged — it is resolved at runtime, consistent with CFG050/054. A sslmode=disable connection string to a loopback host (localhost, 127.0.0.1, ::1) is also not flagged — there is no network path to MITM, and disabling TLS to a local dev database is conventional. Disjoint from CFG020 (NODE_OPTIONS/LD_PRELOAD code injection) and CFG021 (proxy routing) — neither touches cert validation, so there is no double report.

Trigger example

{
  "mcpServers": {
    "api": {
      "command": "node",
      "args": ["server.js"],
      "env": { "NODE_TLS_REJECT_UNAUTHORIZED": "0" }
    }
  }
}

→ error: TLS verification is off, so an https:// upstream is MITM-able regardless of scheme.

Safe alternative

Leave certificate verification on. If the upstream uses a private CA, point the client at that CA bundle (e.g. NODE_EXTRA_CA_CERTS=/path/to/ca.pem, REQUESTS_CA_BUNDLE=/path/to/ca.pem) instead of disabling verification.

{ "mcpServers": { "api": { "command": "node", "args": ["server.js"],
  "env": { "NODE_EXTRA_CA_CERTS": "/etc/ssl/corp-ca.pem" } } } }

References

CFG049 (remote MCP endpoint), CFG068 (templated credential to cleartext endpoint), CFG069 (HTTP-transport log redaction) — the other halves of the MCP-transport-confidentiality family
Claude Code MCP configuration

Documentation for cfgaudit 1.18.1. Source of this page · Rule implementation