MCPGrade scores MCP server security after audit finds 65% lack authentication

Two-thirds of audited MCP endpoints accept unauthenticated calls

A security audit has surfaced a sobering number for anyone running Model Context Protocol infrastructure. Writing on dev.to, Syed Zada Abrar, founder and CEO of SentinelReign, reports that a review of 5,308 public MCP HTTP/SSE endpoints found more than 3,450 of them — about 65% — would carry out tool actions for callers who never had to prove who they were. The research was conducted under SentinelReign, and the post describes MCP as having become the default way to wire AI models up to external tools and data.

The protocol's rise has been rapid, and the numbers suggest operational discipline has not kept pace. Because MCP tools can range from harmless lookups to file operations and outbound API calls, an endpoint with no transport authentication is effectively an open lever into whatever systems the server touches.

MCPGrade: 39 checks across four weighted domains

Alongside the audit, Abrar is introducing MCPGrade, currently at version 1.4.0. It rates an MCP server against 39 individual checks spread over four domains, each weighted in the final score:

• Transport Authentication — 10 checks, 35% of the rating
• Tool Scope & Authorization — 12 checks, 30%
• Input Validation & Injection — 9 checks, 20%
• Rate Limiting & Audit Logging — 8 checks, 15%

The heaviest weight lands on precisely the weakness the audit exposed: verifying the identity of the connecting party before anything else happens. According to the post, a hosted scanner that assigns letter grades from A to F is available through the Andrax Pentester project.

What each domain is meant to catch

The four categories map onto the main ways an MCP deployment can go wrong. Transport authentication determines whether arbitrary parties can reach the server at all. Tool scope and authorization asks whether the available tools, and the data they touch, are limited to what a given client actually needs. Input validation addresses injection risk, since tool parameters are a natural channel for prompt and command injection when a model passes user-controlled text downstream. Rate limiting and audit logging, weighted lightest, cover abuse containment and the ability to reconstruct events after an incident.

Read the numbers with context

The findings come from a single vendor's research published as a personal blog post, and the methodology — how the 5,308 endpoints were discovered, or what qualified as public — is not spelled out in detail. The 65% figure is best treated as one team's measurement rather than an industry-wide census. It is also worth noting that the organisation reporting the gap is the same one releasing the scoring tool designed to close it, a pattern common in security research but worth keeping in mind when weighing the claims.

Why it matters

MCP servers sit at the junction between language models and the systems those models can act on, which makes them unusually consequential attack surface: a misconfigured endpoint is not just a data exposure but a remote trigger for real-world actions. If two-thirds of publicly reachable endpoints genuinely accept unauthenticated tool calls, the emerging agent ecosystem is being built on plumbing that anyone can operate. A grading scheme like MCPGrade will not fix the problem by itself, but it converts a vague question — is my server secure? — into a concrete, prioritised checklist that starts with the transport layer, where the audit suggests the largest hole sits.