40% of MCP servers require no authentication, audit finds

A security audit found that 40% of MCP servers run with no authentication at all, per Codersera. Anyone running one for internal tools or a customer-facing agent has three ways in. No login screen, an injectable tool input, or a credentials file an attacker doesn't even need to crack.

The audit lays out five fixes. Use OAuth 2.1 with mandatory PKCE, not optional. Validate the token's audience so one scoped for a single service can't get replayed against another.

Allow-list every tool input instead of trusting what comes in. Block egress to private IP ranges so a compromised tool can't pivot into your internal network over SSRF. And never forward the client's token upstream to another service.

That's the rule Codersera says people miss, and it's the one that matters most. Passing a user's token to a downstream MCP server looks like normal auth delegation. It also means one compromised server inherits the permissions of every service it talks to. If you've chained MCP servers together, audit that chain before anything else on this list.

Most teams will fix the obvious stuff, the missing auth and the plaintext secrets, and skip the token-forwarding review because no scanner flags it. That's the hole that gets used first.