MCPP-TRN04: Plain HTTP not redirected to HTTPS

Family	Transport
Default severity	medium
Confidence	high
Mode	passive (default scan)
Spec revisions	all

Why it matters

When the plain-HTTP port answers with content instead of a redirect, misconfigured clients can send tokens in clear text without noticing.

Remediation

Answer every plain HTTP request with a 301/308 redirect to the HTTPS URL (and never process the request), or close port 80 entirely.

References

• RFC 6797 HTTP Strict Transport Security
• MCP 2025-11-25 Authorization

Suppressing

# .mcp-posture-ignore
[[ignore]]
check = "MCPP-TRN04"
target = "https://mcp.example.com/*"
justification = "Why this is acceptable here"
expires = 2026-12-31