A First Measurement Study on Authentication Security in Real-World Remote MCP Servers

2026-05-21

AI Summary

This study addresses the lack of systematic investigation into authentication security for remote MCP servers, which commonly suffer from misconfigurations that can lead to information disclosure and account takeover. Focusing on the distinctive usage patterns of OAuth in MCP environments, we identify three key characteristics: open client environments, dynamic client registration, and delegated authorization. Building on these, we propose a vulnerability taxonomy comprising four categories—three specific to MCP deployments and one reflecting traditional OAuth misconfigurations—encompassing nine distinct vulnerability types. Using a semi-automated framework combining passive traffic analysis and active probing, we examined 119 OAuth-enabled MCP servers, uncovering 325 vulnerabilities; 96.6% exhibited flaws in dynamic registration, and every server contained at least one vulnerability, leading to the assignment of nine CVEs.

Abstract

The Model Context Protocol (MCP) is emerging as a common interface connecting large language models (LLMs) with external services. Remote deployments are becoming increasingly important as agents connect to user-linked online services, such as social, productivity, and financial services. In such deployments, the authentication boundary between MCP clients and remote servers becomes security-critical, yet remains underexplored. We present the first measurement study of authentication security in real-world remote MCP servers. We identify 7,973 live remote MCP servers, finding that 40.55% expose tools without authentication. Among authenticated servers, OAuth is the dominant authorization mechanism for reaching remote services, and OAuth deployments in the MCP ecosystem commonly exhibit three characteristics: open client environments, dynamic client registration, and delegated authorization. These characteristics distinguish MCP deployments from traditional OAuth and introduce new attack surfaces. Guided by this observation, we derive a taxonomy of authentication flaws comprising three MCP-specific categories and conventional OAuth misconfigurations, for a total of four categories and nine concrete flaw types. To evaluate these flaws at scale, we implement a semi-automated detection framework that combines passive traffic inspection with active dynamic probing. Applying it to 119 testable real-world OAuth-enabled MCP servers, we find that each server exhibits at least one flaw, with a total of 325 flaws identified, among which dynamic client registration flaws affect 96.6% of tested servers. Many of these flaws can lead to sensitive information leakage and account takeover. Through responsible disclosure, we obtained 9 CVE IDs. Our findings expose pervasive authentication weaknesses in the MCP ecosystem and underscore the urgent need for hardened OAuth-based remote deployments.

Problem

• Authentication Security
• Model Context Protocol
• OAuth Misconfigurations
• Remote MCP Servers
• Security Vulnerabilities

Innovation

• Model Context Protocol
• OAuth security
• authentication flaws
• dynamic client registration
• measurement study