CRITICAL MCP server: MCP server exposed without authentication
Why it matters
Your MCP server answers anyone on the internet. MCP servers are built for local use and ship with no auth by default, but once public, any stranger can enumerate and CALL your tools: read files, run shell commands, query databases, whatever the server can do. This is tool execution by anonymous attackers, not just information disclosure.
Fix it — 3 steps
- If it is meant to be local: bind it to 127.0.0.1 or your VPN interface, and block the port (`sudo ufw deny <port>`). Most MCP servers are never meant to be public.
- If it must be remote, put it behind an authenticating reverse proxy with TLS, or use the framework's auth support (API key / OAuth) if it has any.
- Audit what the server can do: an exposed MCP with exec/shell/filesystem tools is a remote shell. Remove dangerous tools before any exposure.
Verify it’s fixed
curl -s http://YOUR_SERVER_IP:PORT/sse # should not return an event-stream to strangers
References
Not sure if your stack is exposed?
Run the free check — 30 seconds, safe read-only probes.
Scan your stack