MCP Security Kit by Agent Trust Cloud

info

Remote MCP server with no credentials configured

A remote server has no headers or auth settings in the config.

Why it matters

That's fine when the server uses OAuth sign-in. If it's meant to be private and accepts anonymous calls, anyone who finds the URL can use its tools.

How to fix it

Confirm the server requires authentication, and prefer OAuth or a header that references a variable.

Before

{
  "mcpServers": {
    "crm": {
      "url": "https://mcp.example.com/crm"
    }
  }
}

After

{
  "mcpServers": {
    "crm": {
      "url": "https://mcp.example.com/crm",
      "headers": {
        "Authorization": "Bearer ${CRM_TOKEN}"
      }
    }
  }
}

Illustrative configs. The checker flags the “before” version with this finding and not the “after” version.

Check your own config

Other checks