AGENTFORCE-MCP-07: MCP Server Network Exposure
🔴 High · Headless MCP Access
Detects MCP servers configured with non-localhost bind addresses (0.0.0.0 or external IPs) or remote connections without TLS enforcement. Prevents unauthorized network access to MCP tool endpoints.
Details
| Field | Value |
|---|---|
| Rule ID | AGENTFORCE-MCP-07 |
| Severity | High |
| Category | Headless MCP Access |
Remediation
Bind to localhost (127.0.0.1) instead, or use Agent Fabric Flex Gateway as a TLS-terminating proxy.