Four in Ten Public MCP Servers Have No Authentication at All

Researchers scanned 7,973 live remote MCP servers and found 3,233 of them, 40.55%, exposing their tools with no authentication at all. Anyone who knows the URL can call them. The figure comes from Zhou et al., ["A First Measurement Study on Authentication Security in Real-World Remote MCP Servers"](https://arxiv.org/abs/2605.22333), submitted 21 May 2026.

Developers put the number lower. In a Zuplo survey of roughly 100 technical professionals from the MCP community, fielded from mid-November to mid-December 2025, about a quarter said their own servers run without authentication. If your agents call servers you don't operate, that gap is the population you're drawing from.

How many MCP servers have no authentication?

Two independent scans put it near 40%. Zhou et al. found 3,233 of 7,973 live remote MCP servers, 40.55%, exposing their tools with no authentication (arXiv:2605.22333, May 2026). The [Canopii MCP Security Index](https://index.canopii.dev/mcp-security-index) reported 38% across 20,684 scanned servers as of 30 August 2026. The two used different methods and landed close together.

Canopii re-scans continuously, so read its number as a measurement taken on a date, not a fixed fact.

A third study measured something adjacent. Padilla's ["Exposed by Design"](https://arxiv.org/abs/2608.00150), published 31 July 2026, audited 414 internet-facing MCP servers, out of 640 confirmed production servers, and found 91.8% lack OAuth. That's a different measurement: a server checking a static API key counts inside the 91.8% and sits outside the 40.55%.

OAuth on its own hasn't been clean either. The same Zhou paper tested 119 OAuth-enabled MCP servers and found at least one authentication flaw in every one, 325 flaws in total with nine assigned CVEs.

|---|---|---|---|

| Astrix Research, State of MCP Server Security 2025 (October 2025) | 5,205 open-source implementations, from READMEs | documented credential type | 53% static keys or PATs, 8.5% OAuth |

The Astrix row reads READMEs, not live endpoints, so it describes what maintainers documented.

Is anyone running the servers your agents call?

Many of them are unattended. Padilla's audit re-scanned confirmed production MCP servers three days apart and found 41.6% had disappeared in between (arXiv:2608.00150, July 2026). A server that vanishes inside a week has no operator watching it and nobody to tell you when its behaviour changes.

Credential handling matches that picture. Astrix Research read the READMEs of 5,205 open-source MCP server implementations and found 53% rely on long-lived static API keys or personal access tokens, with 8.5% using OAuth (State of MCP Server Security 2025, October 2025). A static key that never rotates survives every laptop it ever touched.

VIPER-MCP scanned 39,884 open-source MCP server repositories and reported 106 zero-days with 67 assigned CVEs ([arXiv:2605.21392](https://arxiv.org/abs/2605.21392), May 2026). OWASP has begun cataloguing the categories in an MCP Top 10, an Incubator project still in beta, with entries numbered MCP01:2025 through MCP10:2025. The numbering tells you how young this work is.

Does authentication bound what an agent spends?

No. Authentication answers which caller may reach a tool. It carries no amount, no merchant and no time window, so a $40 API top-up and a $40,000 annual licence bought through the same authenticated tool look identical to the check at the door. Fixing MCP authentication closes one hole and leaves the spending question open.

The protocol side has been explicit about the split. [MCP's roadmap puts agent identity in its priority list and payments nowhere on it](/blog/mcp-roadmap-agent-identity-not-payments), a scoping decision rather than an oversight.

Picture the good case. Every MCP server your agent touches sits on the right side of that 40%, with narrow scopes. Your research agent holds a valid credential for a data vendor's tool, reads a poisoned page, and commits to a $4,000 annual plan nobody budgeted for. Every authentication check passed.

So treating unauthenticated MCP servers as the whole problem leaves the expensive half standing. Hardening the door is worth doing, and it governs entry rather than spend.

What do you do about servers you don't control?

Put the limit somewhere you control. You can't patch someone else's MCP server or keep it online, and the set of servers your agents reach changes the moment one finds a new tool. A control attached to the purchasing instrument covers every merchant and every tool that instrument can reach, including the ones nobody predicted.

Shatale issues agent-scoped virtual cards with your policy enforced at the authorization moment, human approval workflows above the thresholds you set, and an immutable per-agent record of every decision. A purchase outside policy is blocked or escalated for approval while the merchant is still waiting on the authorization. None of that depends on how the server at the other end handled its tokens.

If you're charging agents for tool calls rather than paying them, the metering questions are in [how to price MCP tools](/blog/how-to-price-mcp-tools).

What to ask

Which MCP servers do our agents reach, and how many authenticate the caller at all?
If every one of those servers checked our credential correctly, what stops a purchase we didn't intend?
Where does our spending policy live, and can finance change it without an engineering deploy?
At what moment in the transaction is that policy evaluated?
Is a purchase outside policy blocked or escalated to a person, and is the record immutable and scoped per agent?

FAQ

How many MCP servers have no authentication?

A measurement study of 7,973 live remote MCP servers found 3,233, or 40.55%, exposing their tools with no authentication (Zhou et al., arXiv:2605.22333, May 2026). The Canopii MCP Security Index, which re-scans continuously, reported 38% across 20,684 servers as of 30 August 2026. Developer surveys put it lower: roughly a quarter, in a Zuplo survey of about 100 respondents fielded in late 2025.

Does OAuth on an MCP server mean it's secure?

Not on the published evidence. Zhou et al. tested 119 OAuth-enabled MCP servers and found at least one authentication flaw in every one, 325 flaws in total with nine assigned CVEs. Separately, an audit of 414 internet-facing servers found 91.8% lack OAuth entirely (arXiv:2608.00150, July 2026). Absence of OAuth is a different measurement from absence of any authentication, and the two don't add together.

Can OAuth scopes limit what an agent spends?

Scopes gate which operations an agent may perform, so they decide whether it reaches a purchasing tool at all. They carry no amount, no merchant and no time window, so a $12 purchase and a $12,000 purchase through the same tool look the same to a scope check. Spending limits get evaluated against a specific transaction, by whoever runs the card programme.

What happens if an MCP server my agent uses goes offline?

Expect it. An audit of confirmed production MCP servers found 41.6% had disappeared between scans three days apart (arXiv:2608.00150, July 2026). A tool call that worked yesterday fails today, and a domain can change hands while your credential still points at it. Controls attached to your payment instrument survive that. Controls configured server by server don't.

---

[Identity, authorization and audit are three separate questions](/blog/agent-identity-vs-authorization-vs-audit), and MCP authentication only closes the first. Early access is free for publishers.

Shatale is the control layer for AI-agent payments. Its authorization architecture is the subject of European patent application EP26194994.5 (filed; priority 28 July 2026).