AG-027
Unprotected Tool Connection
medium
Page text and source link for your AI assistant. Nothing is sent automatically.
What Foo Guard detects
A declared tool connection uses non-loopback HTTP or explicitly disables HTTPS certificate verification. Actual connectivity and compensating network controls are not tested.
When this rule triggers
The rule triggers when A declared tool connection uses non-loopback HTTP or explicitly disables HTTPS certificate verification. Actual connectivity and compensating network controls are not tested.
Foo Guard evaluates the normalized configuration supplied to the scanner. A finding describes configuration risk; it does not establish that an attack occurred. An absent finding does not prove that an undeclared capability is safe.
How to fix
Use HTTPS with certificate verification enabled. Configure the trusted certificate authority for private services rather than disabling verification. Review any tunnel or proxy boundary separately.
Use HTTPS with certificate verification enabled. Configure the trusted certificate authority for private services rather than disabling verification. Review any tunnel or proxy boundary separately.
Verify the change
Update the actual agent configuration and the underlying permissions or controls, then run the scanner again. Inspect the finding’s evidence path to confirm the intended setting changed. Do not clear a finding by changing a declaration that no longer reflects the deployed agent.
Test the affected workflow in an isolated environment, including an operation that should be denied. Keep related findings in view: fixing this rule does not automatically resolve other identity, permission, tool, or audit risks.