Remote MCP server connected without authentication

MediumAV-MCP-103MCPMCP config pack

What it finds

A remote (HTTP/SSE) MCP server is configured with no authorization header or OAuth.

Without authentication you cannot be sure you are talking to the real server, and the server cannot tell you apart from anyone else using the URL.

What an attacker could do: A spoofed or shared server could feed the AI malicious tool results or instructions.

Only connect to remote MCP servers you trust, over HTTPS, using OAuth or an Authorization header with a scoped token.

Pro shows the corrected code for your exact file, step by step, and re-scans to confirm the fix. See plans

Finding code: MCP_REMOTE_SERVER_NO_AUTH
How it detects: Looks for a risky pattern, and stays quiet when a matching safeguard is present.
Confidence: Likely: strong signal, but review it in context.
Scans: MCP client configuration files: claude_desktop_config.json, .cursor/mcp.json, .vscode/mcp.json, .mcp.json
OWASP LLM Top 10: LLM07 - Insecure Plugin Design, LLM05 - Supply Chain Vulnerabilities
NIST AI RMF: GV-4.1
SOC 2: CC6.6

Paste your agent code or MCP config. The free scan runs all 124 checks in about 10 seconds — no account needed.