Skip to content
AdminKit
Check my IP
Coming with the API Updated October 21, 2026

MCP endpoint check: is your MCP server exposed without auth?

Will probe an MCP server's initialize and tools/list calls to check whether authentication is required and which tools are exposed, with a plain-language severity note based on what those tool names and descriptions suggest they can do. Coming with the AdminKit Check API.

Coming with the AdminKit API

Whether an MCP server's initialize call succeeds without credentials, and which tools tools/list then reveals.

  • Unauthenticated initialize and tools/list probes only — no tool is ever called
  • A plain-language severity note based on what the exposed tools suggest they can do
  • Ships with the AdminKit Check API, built on the same checks/mcp library as the MCP/Agent Gateway product

Next step

Also check security headers or open ports on the same host.

How it works and limits

The Model Context Protocol (MCP) lets AI agents call tools exposed by a server — file access, database queries, shell commands, depending on what the server implements. An MCP server reachable on the internet without authentication lets anyone call those tools, not just the agent it was built for.

What it will check

  • Whether an MCP server’s initialize call succeeds without credentials.
  • If so, whether tools/list then reveals which tools are exposed, without calling any of them.
  • A plain-language severity note based on what the tool names and descriptions suggest they can do.

Why this is not live yet

It ships with the AdminKit Check API, built on the same checks/mcp library used by AdminKit’s MCP/Agent Gateway product, so the probe logic is written and tested once.

Check manually today

For an HTTP-based MCP server, a minimal unauthenticated initialize request looks like:

curl -s -X POST https://host/mcp -H 'content-type: application/json' \
  -d '{"jsonrpc":"2.0","id":1,"method":"initialize","params":{}}'

A response without an authentication error suggests the server accepts unauthenticated calls — only test an MCP server you own or are authorized to test, and stop at initialize/tools/list; do not call any tool it exposes.

Frequently asked questions

Why is this tool not live yet?

It ships with the AdminKit Check API (plan milestone M5), using the checks/mcp library built in parallel (plan milestone M3).

Why does an open MCP server matter?

An MCP server without authentication lets anyone call its tools, which can mean arbitrary file, database or shell access depending on what the server exposes.

Related tools