Unauthenticated MCP Server

What Is Unauthenticated MCP Server?

An MCP server is a network service. Anything that can reach it can invoke its tools unless the server makes the caller prove who it is, and approval by a governance process is not that proof. You'll find a server answering on a public port where an unauthenticated tools/list returns everything it reaches, including finance warehouse tools that hand back named accounts and contract values. It was registered and approved, then bound to 0.0.0.0 for a pilot. You'll enforce OAuth 2.1 at the gateway and validate the token audience.

What You'll Learn in Unauthenticated MCP Server

• Recognize that an MCP server is a network service whose tools become an open RPC interface to whatever they connect to when the server requires no authentication
• Understand why server approval and server authentication are separate controls, so an inventoried, approved server can still serve anonymous callers and pass a governance review
• Explain what an unauthenticated tools/list response gives away, and why protocol discovery stops being harmless once anyone can ask
• Apply OAuth 2.1 as a protected-resource requirement and validate the token audience so a credential issued for another service is rejected
• Recognize a transport bound to 0.0.0.0 as a deployment defect that outlives the pilot it was created for and is invisible in an inventory
• Verify a remediation by replaying the request that previously succeeded, rather than trusting the configuration flag that claims to have changed it

Unauthenticated MCP Server — Training Steps

1. A Host That Should Not Answer

   Bob is after Sarnholt Systems' revenue pipeline: which accounts are worth what, and when each one renews. A passive DNS sweep of sarnholt.com turned up a host that none of the company's published services point at.

2. It Introduces Itself

   An MCP server's job is to tell a client what it can do. Bob asks it the same question any connected agent would ask, and sends no credential of any kind.

3. Calling the One That Matters

   Listing tools is reconnaissance. Invoking one is the attack, and it takes the same shape: a JSON-RPC request over the same open endpoint, with the same absent credential.

4. Revenue, To Anyone Who Asks

   The warehouse answered.

5. Check: What Actually Failed

   One question before the story moves to Sarnholt.

6. Someone Else Found It Too

   Alice keeps Sarnholt's MCP servers running: how they are deployed, what they bind to, and what sits in front of them. The disclosure inbox is not usually where her morning starts.

7. Confirming It From Her Own Desk

   A disclosure is a claim until someone reproduces it. Alice sends the same discovery call the report describes, with no credential attached.

8. Where the Answer Lives

   The server is not the place to fix this. Sarnholt runs every MCP server through a gateway that holds their registration, their approvals, and their authentication policy.

9. Signing In to the Gateway

   The gateway console is where server authentication is configured for the whole fleet.

10. Approved, And Wide Open

    The console answers the question the disclosure raised, and the answer is worse than a rogue deployment would have been.