MCP auth audit scans 277 servers: 21% accept tools/list with no credentials, 6 criticals found
SarahVoge · reddit · 2026-11-06
A follow-up from patchbay, a free CLI built with Claude Code that audits public MCP servers for OAuth 2.1 gaps: 277 servers scanned with 100% deterministic results, 55 of 264 reachable servers (21%) respond to tools/list with no credentials, and 6 criticals confirmed after manual review. New checks shipped from community feedback include manifest pinning (MANIFEST-001), RFC 8707 audience-token probing (AUDIENCE-001), and --fail-on for CI. 76 servers serve OAuth metadata without advertising resourceindicatorssupported, and only 6% of hosts publish security.txt. MIT-licensed, no backend, aggregate data published openly.
More from coding & agent
- 'Software factory' is just marketing: good engineering is a kitchen where agents cook and engineers run the pass — 0xkarasy · 2026-11-07
- The AI discount trap: why demanding cheaper AI-assisted development can cost you more — luisdans · 2026-11-07
- Founder wires an agent to check his product's ranking every 10 minutes and ping Discord — pramodk73 · 2026-11-07
- Two engineers argue whether prompting still matters in the agent era, with a pipeline-fix prompt example — teodorio · 2026-11-07
- Hermes-Agent hacks Echo Show 5: screen is just a web page you can customize — alexcovo_eth · 2026-11-07
- 5 vibe coding component libraries worth pasting into Claude or Cursor — thisiskp_ · 2026-11-07