Missing Authentication on MCP Server

Description

An MCP server was found to accept connections without requiring authentication. Depending on the server configuration and intended deployment, unauthenticated access may be intentional, such as for a publicly accessible service, or may indicate that authentication controls are absent. If the server is intended to restrict access to authenticated clients, the lack of authentication may allow unauthenticated parties to connect and interact with the server.

Recommendation

Determine whether the MCP server is intended to be publicly accessible or restricted to authenticated clients. If authentication is required by the deployment or security requirements, implement and enforce an appropriate authentication mechanism, validate credentials on the server side, and reject unauthenticated connections. Where applicable, enforce authorization for tools, resources, and other operations. Do not treat the absence of authentication as a vulnerability solely because the server accepts unauthenticated connections; assess the intended access model and exposure before determining the finding severity.

References

• Model Context Protocol: Security Best Practices