Check M5 · agent surface family · severity HIGH · automatic · one of the 10 MCP-server checks
Maps to OWASP LLM03 OWASP LLM06 ATLAS AML.T0010.005 A remote server is an agent tool running on someone else's machine, with the agent's requests as its input.
The question this check asks: where will your agent send its requests, and is anything about the server that answers there readable at all?
A remote MCP server runs on its operator's machine. Every request your agent makes — and whatever it puts in them — goes there, and nothing about what the server does with it can be read from a listing: there is no package to judge and no code to scan. That is why the owner's rule is that a remote-only server is REVIEW at best and never a pass. Plain http adds a second exposure: anything on the path can read and change the traffic.
A listing with remote endpoints and no package is mcpr-remote-only, MEDIUM and 4 points, on every listing, old or new — never a pass. An endpoint over plain http off loopback is mcpr-remote-plain-http:<host>, HIGH and 10 points; a scheme that is not https is MEDIUM. Each https endpoint is a note naming its host, and a host the user fills in is a note saying so. More than twenty endpoints is a MEDIUM finding naming how many were not read. Warnings under the default profile, never a block on their own.
Every hosted server from a well-known vendor is a REVIEW under this rule, because what runs on the vendor's machine is not readable from here. That is the rule working as decided, not a misread.
The server itself: an endpoint is never contacted. The operator behind a host. An address no listing declares, which the preflight asks about.
Scope, the same on every page of this roster: RepoGates does not see git clone, package managers or curl — outside Claude Code with the RepoGates plugin, whose hook refuses a clone or install that names a blocked repository on the command line, before it runs. The hook sees Bash tool calls in that one client and nothing else. On a claude mcp add line, a remote address that a listed server declares is judged with that listing's verdict riding along, and is still an ask: anyone may declare any address in a listing, and the server answering there runs on its operator's machine. A listing whose verdict is BLOCK is denied. An address no listed server declares is asked about. A server added by editing a configuration file or through /mcp is not a shell line the hook sees. Edit and Write are read for one thing only — an API key about to be saved — checked on the machine and never sent; that guard asks, it never denies. This roster reads what the official MCP registry publishes about a server — its record, its version history, the repository and packages it declares, the remote addresses it names — and never the server's code or what it does once it runs. A remote-only server is REVIEW at best, never a pass. The registry carries no download count, star count or popularity of any kind, so there is no lookalike check. A server the registry no longer serves is not assessed, never a pass. A PASS means nothing matched on what was read.
curl -s "https://registry.modelcontextprotocol.io/v0/servers/NAMESPACE%2FNAME/versions/latest" | jq '[.server.remotes[]? | {type, url}]'Why is a remote-only server never a pass? It runs on its operator's machine, and nothing about what it does with your agent's requests can be read from the listing. The owner's rule is REVIEW at best, so every remote-only listing carries a medium finding.
What happens when I add a listed remote server with claude mcp add? The plugin's hook sends the line; the address is matched to the listings that declare it and their verdict rides along. It is still an ask, because anyone may declare any address; a listing whose verdict is BLOCK is denied.
What about an address no listing declares? It is asked about, with the reason that the registry does not list it.
M7 Secrets requested · M4 Launched package · S14 MCP servers.
Add RepoGates to Chrome Pricing
Sources for this page: the severities and weights from the product's own roster and scoring tables, and the official MCP registry's published record format. See also the MCP servers intelligence page.