atomic-agents-stack accepted remote MCP catalogs over cleartext HTTP and passed catalog commands to its process launcher. The repair rejects remote cleartext transport by default and adds a command allowlist.

@@ -0,0 +1112,18 @@+    from urllib.parse import urlparse, urlunparse, parse_qs++    if not url or not url.strip():+        raise ValueError("HTTPMCPServerRegistryBackend catalog URL must not be empty.")++    parsed = urlparse(url)+    if parsed.scheme not in ("http", "https"):+        # Redact embedded credentials per S-F1: if the operator pastes a URL+        # like ftp://user:pass@host/ the raw URL must not appear in the error+        # message. Mirrors the PR 1 P0 redaction discipline.

+        raise ValueError(+            f"HTTPMCPServerRegistryBackend catalog URL must start with "+            f"http:// or https://, got {_redact_url_for_error(url)!r}"+        )++    # Extract agent_scope from query params.+    query_params = parse_qs(parsed.query, keep_blank_values=False)+    agent_scope_values = query_params.pop("agent_scope", None)

@@ -126,0 +236,18 @@++    # Path 1 — https always allowed.+    if scheme == "https":+        return++    # Paths 2 + 3 — http with host classification.+    if scheme == "http":+        # hostname is already lowercased by urlparse; use it for loopback check.+        if _is_loopback_host(hostname):+            # LOOPBACK-AUTO: always allowed regardless of opt-in.

+            return+        if allow_http_non_loopback:+            # ENV OPT-IN: operator has explicitly unlocked non-loopback http.+            return+        # Non-loopback http without opt-in → refuse.+        safe_url = _redact_url_for_error(url)+        raise ValueError(+            f"HTTPMCPServerRegistryBackend: cleartext http:// is refused for "