reap / rules / transport posture
Plaintext agent listener alongside TLS on the same host
transport-downgrade ASI07 Insecure Inter-Agent Communication severity: medium
What it detects
The same host also accepts agent traffic in the clear alongside TLS. ASI07.
On an https:// target, probes for a plaintext-HTTP listener on the same host/path (and /sse) that also serves MCP traffic.
applies to any agent endpoint over HTTP
Why it matters
A plaintext listener on the same host defeats the TLS the endpoint otherwise offers.
On reap-range
| insecure target | not exercised (see limitation below) |
| correct target | — |
Run only this check
reap -t https://your-host/mcp --authorized --include transport-downgrade
Not installed? Install REAP. Only scan systems you own or are authorised to test. Reference: docs/PROBES.md.