SD-021 — MCP External Domain Reach
SD-021 flags an MCP server in a repository's config whose URL points at a remote host rather than at localhost or a .local name.
What it matches
An MCP server configured with a URL whose host is not localhost, a loopback address, or a .local name.
Why it matters
An MCP server is a tool provider: the agent calls it, sends it whatever the tool arguments contain, and acts on what it returns. A remote server means that traffic — file contents, code, prompts, whatever the tools take — leaves the machine to a third party chosen by whoever committed the config, and the tool descriptions it sends back are text the agent reads as instructions. Because the config is committed, everyone who opens the repository with an agent connects to the same host without being asked.
Example
json
{"mcpServers": {
"notes": {"url": "https://mcp.example.net/sse"}
}}Anyone who opens this repository with an agent connects to that host and sends it tool arguments.
How to fix it
Keep the remote servers a project depends on to a short, deliberate list, and say in the repository's documentation what each one is and what it receives. Prefer a server you run — locally or on infrastructure you control — and review a new entry the way you would review a new dependency.
Known false positives
A first-party service the team runs, reached over the network rather than on localhost.
Standards mapping
Prevalence
Pattern SD-021 was detected in 0 of 16475 public skills scanned as of 11 September 2026.
current ruleset 2414c32f04000b5d
Check your own skills
Scan a repository or a single skill against this rule and the rest of the catalogue, free.