Tip: Audit Every MCP Server for Authentication — Default Configs Ship Without Auth

The Register·high signal

The three-database MCP disclosure (Doris, Pinot, RDS) reveals a systemic pattern: MCP servers ship with HTTP endpoints that accept unauthenticated requests by default. Before enabling any database MCP server, check whether it requires authentication on the transport layer. Apache Pinot's fix added OAuth as optional (not default) in v2.0.0 — meaning unpatched or misconfigured instances remain exploitable. For any MCP server you run: verify auth is enforced, not just available.