SD-021 — MCP External Domain Reach

SD-021 flags an MCP server in a repository's config whose URL points at a remote host rather than at localhost or a .local name.

What it matches

An MCP server configured with a URL whose host is not localhost, a loopback address, or a .local name.

Why it matters

An MCP server is a tool provider: the agent calls it, sends it whatever the tool arguments contain, and acts on what it returns. A remote server means that traffic — file contents, code, prompts, whatever the tools take — leaves the machine to a third party chosen by whoever committed the config, and the tool descriptions it sends back are text the agent reads as instructions. Because the config is committed, everyone who opens the repository with an agent connects to the same host without being asked.

Example

json

{"mcpServers": {
  "notes": {"url": "https://mcp.example.net/sse"}
}}

Anyone who opens this repository with an agent connects to that host and sends it tool arguments.

How to fix it

Keep the remote servers a project depends on to a short, deliberate list, and say in the repository's documentation what each one is and what it receives. Prefer a server you run — locally or on infrastructure you control — and review a new entry the way you would review a new dependency.

Known false positives

A first-party service the team runs, reached over the network rather than on localhost.

Standards mapping

OWASP ASI ASI04

CWE CWE-1059

Agent Skills in the Wild E1

Prevalence

mediumpermission_hygiene

Pattern SD-021 was detected in 0 of 16475 public skills scanned as of 11 September 2026.

current ruleset 2414c32f04000b5d

Check your own skills

Scan a repository or a single skill against this rule and the rest of the catalogue, free.