Security audit of 277 MCP servers reveals 34 unauthenticated endpoints and 6 critical write-capable exposures

·2026.11.10 21:52

Key point

A November 2026 scan of 277 Model Context Protocol servers found that 55 respond without authentication, including 6 critical servers exposing write-capable tools.

Details

277 MCP server URLs were scanned in a November 2026 sweep, with 264 found reachable and 55 answering without authentication.
34 servers passed the AUTH-001 check (tools/list succeeds without credentials), of which 6 are critical due to exposed write-capable tools.
Additional vulnerabilities included 28 servers accepting spoofed Origin headers (TRANSPORT-002) and 7 lacking per-tool scopes (SCOPE-001).
The open-source scanner is available at github.com/GodSmasher/patchbay, with a hosted option at patchbay-mcp.dev/scan for individual server checks.

oauth vulnerability mcp model-context-protocol security-audit

Read originalShare on Threads

This summary was generated automatically by AI. Check the original for the author's claims and context. Copyright belongs to the original author.

Our guide explains how the AI works. Report summary errors, attribution issues, or removal requests via Contact.