Should MCP servers hide their tool list until users authenticate? A threat-model analysis
localhost9393 · reddit · 2026-10-12
The MCP spec lets any connected client call tools/list and see everything, no auth required. The author argues there are real cases against this:
- Tool names leak architecture: names like getcustomerbystripeid effectively publish your schema to anyone who can reach the endpoint
- Recon vector: unauthenticated tool discovery hands attackers parameters, paths and high-value operations
- Compliance: HIPAA/SOC 2/financial data doesn't fit a public tools/list model
- Elevated permissions: admin-service-account or destructive tools shouldn't be discoverable by URL finders
- Staged rollouts: private servers with sharing controls act as a natural waitlist
He implemented this in Shredly, his hosted MCP platform: the server stores upstream keys encrypted, callers authenticate first, and only then is the upstream key injected — shifting access control from call time to discovery time.
More from coding & agent
- SoftwareGym synthesizes 182 app environments, lifting CUA OSWorld Pass@3 to 56.97% — Tian Jin · 2026-10-12
- Claude created a mysterious 30GB 'blind' directory no agent supposedly reads — Sauers_ · 2026-10-12
- AWS+HSBC paper co-evolves agent graders from just 10 labeled examples, matching ground truth — rohanpaul_ai · 2026-10-12
- Haiku 5.5 costs 75% less than 4.5, but shines only as a subagent under Opus 5.5 — Scobleizer · 2026-10-12
- The sneakiest AI coding failure: looping quietly while sounding productive — chich2017 · 2026-10-12
- Phones aren't for work but for delegating: why personal agents are the next big thing — sujingshen · 2026-10-12