We scanned popular MCP servers. The vendors are fine. Your setup might not be.

2026-11-05来源 dev.toEnglish

AI agents now call real tools: they refund orders, send e-mail, edit code, query production databases. Most of them do it through the Model Context Protocol (MCP). So we asked a simple question: how well are MCP servers protected, and what does an agent actually need before it is allowed to act?

To answer it, we built an open-source scanner, pointed it at the hosted MCP servers of well-known vendors, and checked the install instructions of popular local servers. You can run the same scan on your own server at https://scan.themandat.xyz.

What we scanned

Eleven vendor-hosted MCP endpoints (GitHub, Figma, Linear, Sentry, Cloudflare, Hugging Face and others), plus the documented install commands of three popular local servers. The scan is passive: no client registration, no tool calls, no real credentials. It checks authentication on initialize and tools/list, how the server answers an invalid token, OAuth discovery (RFC 9728 and RFC 8414), PKCE, iss in authorization responses (RFC 9207), client registration, CORS, and tool descriptions for hidden instructions.

The big vendors got the basics right

All 7 endpoints that require login answer 401 with a proper discovery challenge, publish their OAuth metadata, support PKCE with S256, reject invalid tokens and return iss. That is the opposite of the ecosystem as a whole: a 2026 measurement study of 7,973 live remote MCP servers (Fudan University, arXiv 2605.22333) found that 40.55% expose their tools with no authentication at all.

What remains is hardening, not open doors:

  • one authorization server still advertises plain PKCE next to S256;
  • one does not return iss in authorization responses;
  • 3 of 7 rely only on Dynamic Client Registration, which MCP revision 2026-07-28 deprecates in favour of Client ID Metadata Documents.

Open does not always mean broken

Four of the eleven endpoints answer without any login. All four serve public documentation and search, so being open is almost certainly intentional. Three of them mark every tool readOnlyHint, which lets clients and scanners recognise a public read-only server. One marks nothing, so no tool can tell "public on purpose" from "forgot to add auth". If your server is public by design, say so in the tool annotations.

The weak spot is on your machine

The official install commands of all three local servers we checked start an unpinned package on every launch (npx … @latest, or no version at all). If a maintainer account is compromised, as happened to postmark-mcp and LiteLLM, the next restart of your MCP client runs the attacker's code with your files and credentials. Pin exact versions in your MCP config and check it in CI.

A protocol change already bites

At least 5 of the 11 servers enforce a rule from MCP revision 2026-07-28: an old-style initialize that carries the new MCP-Protocol-Version header is rejected with 400. Our own scanner sent exactly that until this scan. If you write MCP clients, send that header only after the version has been negotiated.

Scanning is the easy part

A clean scan says the door is locked. It says nothing about what an agent may do once it is inside: refund €20 or €20,000, send mail to a colleague or to an address it read in a phishing e-mail, act for which user, approved by whom.

That is what Mandat is for. It is an open-source layer (Apache-2.0) that sits inside your MCP server and:

  • checks a policy on every tool call, including the arguments: refund ≤ €50 → allow · €50–500 → ask a human · > €500 → deny;
  • gives agents short-lived, single-task tokens that carry the whole chain, person → agent → sub-agent, and can only ever narrow;
  • blocks exfiltration after untrusted input: once a session has read e-mail or web content, sending data outside is refused;
  • writes one tamper-evident audit record per call, exportable to your SIEM, with a report for auditors;
  • revokes an agent in seconds, including every sub-agent it delegated to.

It works with the official MCP SDKs for TypeScript and Python, connects Claude Code, Codex and other clients through a local bridge, and signs people in with Auth0, Okta, Entra ID or Keycloak. The npm package has no runtime dependencies, and every release is built in CI with provenance.

Try it

If you build MCP servers or agents, I'd like to hear what would stop you from using this. Open an issue, or reply here.

原文：https://www.a8q9.cn/en/article/we-scanned-popular-mcp-servers-the-vendors-are-fine-your-setup-might-not-be-8843e5.html

相关文章