Tip: Audit Your Remote MCP Servers for Missing Auth — ~40% Expose Tools Unauthenticated

PipeLab·medium signal

June 2026 scans found roughly 40% of remote MCP servers expose their tools with no authentication, and Censys counted 12,520 internet-reachable MCP services, most unauthenticated. Before connecting an agent to any remote MCP endpoint — or exposing your own — verify it enforces auth on tool calls, and never bind a tool-exposing server to a public interface without it. Treat MCP endpoints like any other API surface: assume internet-facing means attacker-facing.