Rule catalog · Auth discovery posture

Auth-discovery metadata URLs are HTTPS and publicly routable

auth_metadata_urls_https_publichighweight 6Auth-required

Authored by Stanley Hong · AgentReserve (founder).

Every URL advertised in protected resource metadata or authorization server metadata — `authorization_endpoint`, `token_endpoint`, `jwks_uri`, `registration_endpoint`, `revocation_endpoint`, `introspection_endpoint`, and the PRM `resource` — uses HTTPS and resolves to a publicly routable hostname (no loopback, RFC 1918, link-local, or private TLD). The discovery chain has no value if it points clients at the cloud metadata service or the loopback interface.

When this rule runs

Only applies when the server signals that authentication is required (HTTP 401/403). Excluded from the score on public servers.

Why it matters

An MCP client follows whatever URLs the discovery chain advertises. A `token_endpoint` on plain HTTP exposes the token exchange to passive interception; a `jwks_uri` pointing at `169.254.169.254` or `127.0.0.1` is an SSRF primitive into the host running the client. Both classes have shipping CVEs (CVE-2025-65513 and the DNS-rebinding family).

Pass condition

Every URL field in PRM and AS metadata is HTTPS and has a publicly routable hostname (the existing `auth_issuer_uses_https` rule covers issuer URLs separately).

Fail condition

At least one advertised URL is non-HTTPS or resolves to a loopback / RFC 1918 / link-local / IPv6 ULA / private-TLD hostname.

Evidence examples

When the rule fails, the report records evidence in roughly this shape:

  • {"hits": [{"field": "token_endpoint", "url": "http://issuer.example.com/token", "reason": "non-https"}]}
  • {"hits": [{"field": "jwks_uri", "url": "https://127.0.0.1/jwks", "reason": "ipv4-loopback"}]}

Remediation

Serve every advertised endpoint over HTTPS on a publicly routable hostname. Treat the discovery chain as a contract — any URL in PRM/AS metadata is one a client may follow without further validation.

Methodology

This rule belongs to the Auth discovery posture dimension. When authorization is required, whether the server cooperates with the standards-based discovery chain — RFC 9728 protected resource metadata, RFC 8414 authorization server metadata, validated issuers, and safe grant types.

Read the full methodology for how rules are aggregated into a score, how verdicts are decided, and how hard-fail rules override the aggregate.