How to tell if your MCP server is open to strangers

Why an open MCP server is a problem

An MCP (Model Context Protocol) server hands an AI agent its tools: reading files, searching a database, sending email, calling other APIs. The agent connects, asks for the list of tools, and calls them.

If the server is on the internet and doesn't ask for a login, anyone can do the same. They don't need your agent at all. They can connect with any MCP client, see every tool you've exposed, and use them with your data and your API keys.

How it usually happens

Most open servers aren't left open on purpose. The common causes are:

• A quick-start example was deployed as-is. Many examples skip authentication to keep things simple.
• The server was meant for local use, then moved to a cloud host so a hosted agent could reach it.
• A login exists, but only on some routes, or a debug route was left switched on.
• The address is long and random, so it felt private. A hidden URL isn't a login: addresses leak through logs, browser history, screenshots and shared configs.

How to check yours

From a device that isn't logged in to anything, try connecting to your server's public address with an MCP client and asking for its tool list. If you get the list back without giving a token, it's open.

Our free scan does this for you once you've proved you own the server. It connects the same way a client would, lists what's exposed, and ranks each tool by how risky it is to leave open. It never calls a tool.

How to fix it

Put a login in front of every request the server accepts, not just the first one.

• Use the authorization method in the MCP specification (OAuth) if your client supports it, or at least require a secret bearer token on every request.
• Keep the token in an environment variable, never in your code or a config file you commit.
• If only one agent needs the server, limit who can reach it at the network level too, for example by IP address or a private network.
• Remove tools the agent doesn't need. The fewer tools exposed, the less damage a leak can do.
• Scan again after the change to confirm the server now refuses strangers.