HTTP sources over Spring RestClient. Nothing in the base standalone server or Spring Boot starter compiles against this module: the configuration-driven JSON REST mode it implements is a separately reviewed adapter extension, loaded only by an operator who opts in, over the same -Dloader.path=<reviewed extension jar> mechanism task 17 built for any other reviewed adapter. That is what keeps the MCP layer unable to reach a source directly by default.