Is Your MCP Server Actually Locked? The Authentication Gap Nobody's Fixing
40% of live internet-accessible MCP servers have zero authentication. And most that do have it? They're broken. Here's what the first real measurement study found — and what it means if you've deployed a remote server.
If you've shipped an MCP server in the last twelve months, there's a roughly four-in-ten chance anyone on the internet can invoke your tools right now without presenting a single credential. A measurement study published in May 2026 scanned 7,973 live, internet-accessible MCP servers and found that 40.55% of them expose tool interfaces with no authentication whatsoever — no token, no OAuth flow, no API key check. Just an endpoint that executes whatever tools it exposes when something asks it to.
That figure comes from one of the first systematic studies of real-world remote MCP infrastructure. And the question it raises isn't just "why is this happening?" — it's whether the fixes most teams reach for are actually doing much.
Where did this data come from?
Two independent studies sit behind this post. The first is a May 2026 peer-reviewed paper on arXiv (arXiv:2605.22333) — the first formal measurement study of authentication in real-world remote MCP servers. The researchers built a semi-automated framework that combined passive traffic inspection with active dynamic probing, scanned the internet for live MCP infrastructure, and classified each of the 7,973 confirmed servers by authentication status. The second is Astrix Security's October 2025 audit of 5,200 open-source MCP server repositories — a different slice of the ecosystem, covering everything from hobbyist local tools to production deployments.
The numbers differ between the two studies because the populations differ, and understanding that difference is part of the story.
Why does four in ten servers have no auth at all?
The short answer is that MCP started as a local protocol. When the spec launched, the dominant use case was a local stdio connection between an AI client and a server running on the same machine. In that scenario, access control lives at the OS level — authentication is someone else's problem. When teams started moving those same patterns to remote, internet-facing deployments, the auth step often just didn't travel with them. You get a working integration, it passes the demo, and the hardening ticket stays in the backlog.
The arxiv study's auth breakdown makes clear this isn't a small edge case.
Of 7,973 live remote servers: 40.55% have no authentication, 29% use static tokens or API keys, and 30.45% implement OAuth-based flows. If you've seen the 8.5% OAuth figure quoted elsewhere — that's from the Astrix audit, which covers the much larger population of GitHub-hosted repos, most of which are designed for local use rather than internet exposure. Internet-facing deployments do have higher OAuth rates. The deeper problem is what happens when you look closely at those OAuth implementations.
Does switching to OAuth actually solve it?
The same arxiv study that measured the auth gap also did something no previous analysis had done: it actively tested the OAuth implementations it found. Of 119 internet-accessible MCP servers with OAuth that were reachable for probing, every single one had at least one authentication flaw. Not most — all of them. 325 distinct flaws across 119 servers.
The most common flaw type, affecting 96.6% of tested OAuth servers, is a dynamic client registration vulnerability. Here's what that means in practice: MCP's OAuth flow allows clients to register themselves with a server before authenticating. If the server implements this without validating the registering client — checking that it's who it claims to be and that its redirect URI is legitimate — then a malicious agent can register itself as a trusted client and complete the full OAuth handshake. The server has OAuth. It still accepts anyone.
So the real question isn't "do you have OAuth?" — it's "did you implement the dynamic client registration check correctly?" The study's answer is that essentially no one has.
Is this growing faster than teams can fix it?
Unfortunately, yes. Censys internet infrastructure scanning found 12,520 internet-accessible MCP services on April 28, 2026. Nine days later, on May 6, that number had exceeded 21,000. The official MCP Registry listed 9,652 entries as of late May, but community directories show considerably more — one major hub lists upwards of 56,000 servers.
If you apply the 40.55% no-auth rate from the arxiv study to those numbers, you get roughly 5,000–8,500+ unauthenticated internet-facing MCP endpoints at any given point in spring 2026. And that's before accounting for the OAuth servers with broken DCR implementations, which would push the "not actually protected" number much higher.
The open-source repo picture looks different but isn't necessarily more reassuring. Astrix's audit of 5,200 repositories found 53% using static API keys or personal access tokens — long-lived credentials with no expiry, no scope, and no rotation mechanism, often stored in plaintext in environment variable files. A single leaked backup or .env snapshot can expose everything the key has access to.
What should you actually do about this?
Start by confirming your server's auth status. If it's internet-accessible and you haven't explicitly added auth, assume it's in the unauthenticated 40%. The test is straightforward: send a tool-listing request from a machine with no credentials configured and see what comes back. If you get a tool list, you're exposed.
For new remote deployments, the updated MCP spec (finalized July 28, 2026) includes first-class OAuth 2.1 with PKCE as the standard auth mechanism. The spec also added per-tool routing headers — Mcp-Method and Mcp-Name — which let your gateway apply different rate limits per tool name without inspecting the JSON body. Standing up a gateway that enforces auth and per-tool rate limits from the start is significantly easier than retrofitting them later.
For servers already running OAuth, the DCR issue is the one worth auditing. The specific question: when a new client attempts to register, does your server validate the redirect URI against an allowlist and verify client identity before issuing credentials? If you're using a framework that exposes dynamic client registration with defaults, check the defaults — that's where 96.6% of the tested servers went wrong.
The static key problem is a slower burn but a real one. If your MCP server's auth relies on a long-lived API key or PAT passed via an environment variable, the meaningful risk reduction is a rotation schedule and a secrets manager, not additional scopes. Leaked credentials that can't be rotated quickly are the category of incident that makes news.
The measurement study's headline number — four in ten internet-facing MCP servers, wide open — is striking enough that it tends to get read as someone else's problem. It probably isn't.