Remote server with no authentication header

The config sends no credential to this remote server. That is fine when the server signs you in with OAuth (Notion, Linear and other hosted servers do; the client opens a browser login). Otherwise anyone who learns the URL can call it, and you cannot tell who is using it.

each server checks
5 test fixtures

low remote-no-auth

Flagged

  3       "r": {
  4 >       "url": "https://example.com/mcp"
  5       }

Fix

If the server uses OAuth sign-in, nothing to change. Otherwise send a header that references a secret instead of a literal, e.g. "headers": {"Authorization": "Bearer ${input:token}"}.

Fine

{
  "mcpServers": {
    "r": {
      "url": "https://example.com/mcp",
      "headers": {
        "Authorization": "Bearer ${input:tok}"
      }
    }
  }
}

References

https://modelcontextprotocol.io/specification/draft/basic/authorization

← All rules

Running agents in production?Qlucent assesses agent permissions and data boundaries. →