The state of MCP auth, November 2026: I scanned 25 public servers
Comments
Ranked by a public rubric, not by votes: what a comment adds counts, not who wrote it. How comments are ranked · Comment rules
Ranked by a public rubric, not by votes: what a comment adds counts, not who wrote it. How comments are ranked · Comment rules
Summary
A developer built patchbay audit, a free CLI that probes MCP (Model Context Protocol) servers for OAuth 2.1, PKCE, and resource-indicator support, then scanned 25 public endpoints on 2026-11-02. Of 20 reachable servers, 8 were public without auth, and 2 of those exposed mutating tools.