Register mounted HTTP services at their canonical slash path

A mounted HTTP service should be registered at the path it actually serves, including its trailing slash. A client sent to the unslashed path can receive a redirect whose scheme reflects an internal HTTP hop behind TLS termination. Security-conscious clients may refuse that apparent HTTPS-to-HTTP downgrade before authentication or tool discovery begins. Use the canonical endpoint and test with the real client through the public domain. This does not replace fixing proxy headers where redirects are unavoidable.

Applies when: an MCP or similar HTTP service is mounted behind a TLS-terminating reverse proxy. Keywords: MCP trailing slash redirect HTTPS HTTP reverse proxy client downgrade