4 in 10 remote MCP servers let anyone call their tools

40.55% of live remote MCP servers expose their tools without any authentication.

The numbers

1. December 202510,000+

   active public MCP servers, and 97M+ SDK downloads a month.

   Source: Anthropic, 9 Dec 2025

2. Who runs it now

   Rivals co-govern it

   MCP moved to the Linux Foundation’s new Agentic AI Foundation. Platinum members include AWS, Anthropic, Google, Microsoft and OpenAI.

   When competitors share a protocol, it’s here to stay. So are its mistakes.

   Source: Linux Foundation, 9 Dec 2025

3. A 2026 measurement study7,973

   live remote MCP servers found on the internet.

   Source: arXiv 2605.22333, May 2026

4. Same study40.55%

   expose their tools without any authentication.

   Source: arXiv 2605.22333, May 2026 (preprint)

Four checks before launch

1. Authentication on by default. Use the spec’s OAuth flow. No open endpoints.
2. Least privilege per tool. Read-only unless a write is the point.
3. Confirm destructive actions. Delete, pay, send: a human says yes first.
4. Log every call. Who, which tool, what arguments.

Sources

1. Anthropic, Donating the Model Context Protocol and establishing the Agentic AI Foundation, 9 Dec 2025
2. Linux Foundation, Agentic AI Foundation announcement, 9 Dec 2025
3. Zhou et al., A first measurement study on authentication security in real-world remote MCP servers, arXiv 2605.22333, 21 May 2026

Does your MCP server have auth? Tell me on LinkedIn or Instagram.