Most public MCP servers skip authentication entirely

Censys scanned the open internet in June and found 12,520 MCP servers reachable from anywhere. 40% needed no authentication at all. 43% were vulnerable to command injection. 79% handled credentials in plaintext, per Codersera's writeup of the numbers.

That matters because MCP servers aren't passive endpoints. They're tool-execution surfaces. An AI agent connects, gets a list of capabilities, and starts calling them. If the server has shell access, database creds, or an API key baked in, an attacker who reaches it doesn't need to breach anything else. They just ask nicely, the same way the agent would.

Installing an MCP server is installing unvetted code with tool access. That's the plain description of what's happening, and the adoption curve got ahead of anyone writing that down as a warning.

What to actually check

The fixes are boring, which is the point. Require OAuth 2.1 with PKCE and validate the token audience, so a token minted for one server can't be replayed against another. Allow-list every tool input instead of trusting whatever the model passes through. Block SSRF egress to private IP ranges, since a compromised server that can reach [redacted] or your internal network is a much bigger problem than a compromised server that can't. And never let client tokens flow through to upstream APIs unchanged.

None of this is exotic. It's the same checklist any API gateway should pass. The difference is that MCP servers are getting spun up by individual developers wiring an agent to a database over a weekend, not by teams with a security review process. If you're running one, or pointing an agent at someone else's, that gap between how fast these get built and how rarely they get audited is the actual risk.