Skip to content
AdminKit
Free tool Updated

MCP endpoint check: is your MCP server exposed without auth?

How does this check work, and what does the result tell you?

Probes an MCP server's initialize call live via AdminKit's Check API to check whether authentication is required, continuing to tools/list — never calling a tool — when it is not, so you can see whether an AI agent could reach your server's tools without proving who it is, the same way an attacker scanning for exposed MCP endpoints would.

Part of the AI agents & MCP cluster — more tools, guides and terms on ai agents & mcp.

AI explanation Run a check below, then sign in to ask AI to explain the result in plain language.

Next step

Also check security headers or open ports on the same host.

Keep this result

Copy a link to this check so you can share it or run it again later. Want a heads-up when this result changes? Talk to our team and we'll set it up for you.

Set up alerts with our team

How it works and limits

The Model Context Protocol (MCP) lets AI agents call tools exposed by a server — file access, database queries, shell commands, depending on what the server implements. An MCP server reachable on the internet without authentication lets anyone call those tools, not just the agent it was built for, a risk the specification’s own security best practices call out directly.

What it checks

  • Whether an MCP server’s initialize call succeeds without credentials.
  • If so, whether tools/list then reveals which tools are exposed, without calling any of them.
  • If the endpoint does not behave like an MCP server at all (wrong status code, connection refused), it reports that plainly rather than a false pass or fail.

This check targets Streamable HTTP, the transport the specification’s transport security guidance requires authentication for in the first place — a stdio-spawned server relies on the OS process boundary instead and isn’t reachable over the network for this check to probe.

Limits

  • This runs one check of the URL you give it; it does not independently verify the description text a tool reports stays the same across calls, which is the signature of tool poisoning — only that it can read tool names and descriptions at all when the server is unauthenticated.
  • Only test an MCP server you own or are authorized to test — the check itself is non-destructive (it never calls a tool), but reachability probing against a server you do not control can still violate its own terms of use.

Check manually today

For an HTTP-based MCP server, a minimal unauthenticated initialize request looks like:

curl -s -X POST https://host/mcp -H 'content-type: application/json' \
  -d '{"jsonrpc":"2.0","id":1,"method":"initialize","params":{}}'

A response without an authentication error suggests the server accepts unauthenticated calls — only test an MCP server you own or are authorized to test, and stop at initialize/tools/list; do not call any tool it exposes.

Reference: MCP (Model Context Protocol). See also hosted MCP gateway options compared, AdminKit vs MCPScan.ai for how this live endpoint probe differs from a GitHub-repo source scan, and our page for developers & SaaS teams for the fuller picture of what’s free and what Netbase builds and runs for you.

Frequently asked questions

Is this check live?

Yes — it sends a real `initialize` request to the URL you enter via AdminKit's Check API (POST /v1/check/mcp-endpoint), the same endpoint anyone can call anonymously, rate-limited per visitor. Outbound requests are SSRF-guarded: a target resolving to a private or loopback address is refused rather than probed.

Why does an open MCP server matter?

An MCP server without authentication lets anyone call its tools, which can mean arbitrary file, database or shell access depending on what the server exposes.

Will it call any of the tools it finds?

No — the probe stops at `initialize` and, if that succeeds without credentials, `tools/list`. It never invokes a tool the server exposes, so it cannot trigger a file write, database query or shell command.

Can I use this to check someone else's MCP server?

You can point it at any hostname, but as with AdminKit's other active checks you should only test a server you own or are authorized to test — the check itself stays non-destructive (no tool calls), but reachability probing against assets you don't control can still violate the target's own terms of use.