info
Remote MCP server with no credentials configured
A remote server has no headers or auth settings in the config.
Why it matters
That's fine when the server uses OAuth sign-in. If it's meant to be private and accepts anonymous calls, anyone who finds the URL can use its tools.
How to fix it
Confirm the server requires authentication, and prefer OAuth or a header that references a variable.
Before
{
"mcpServers": {
"crm": {
"url": "https://mcp.example.com/crm"
}
}
}After
{
"mcpServers": {
"crm": {
"url": "https://mcp.example.com/crm",
"headers": {
"Authorization": "Bearer ${CRM_TOKEN}"
}
}
}
}Illustrative configs. The checker flags the “before” version with this finding and not the “after” version.
Other checks
- Secret written into an MCP config
- Secret passed as a command-line argument
- Secret inside an MCP server URL
- Remote MCP server over unencrypted http
- Unpinned MCP server package or image
- MCP server installs without asking (npx -y)
- MCP server container runs --privileged
- MCP server container shares the host network
- Broad host folder or Docker socket mounted into an MCP container
- MCP filesystem server with access to a very broad path
- MCP server launched through a shell
- MCP server that can run shell commands
- MCP tools auto-approved or always allowed