{"slug": "one-week-later-97-of-tracked-mcp-servers-trip-a-new-transport-security-check", "title": "One week later: 97% of tracked MCP servers trip a new transport-security check", "summary": "A developer's passive scanner found that 121 of 125 reachable public MCP servers (96.8%) fail a new transport-security header check, missing at least one of four standard headers on the initialize response. The re-scan of a 277-host list, with 130 hosts reachable in both sweeps, also flagged six servers for missing Protected Resource Metadata, six for not advertising the RFC 9207 iss parameter, and three for returning the wrong HTTP status on an invalid bearer token. Grades for hosts including api.githubcopilot.com/mcp, mcp.sentry.io and mcp.supabase.com/mcp dropped from A to C or B as a result.", "body_md": "Last week I ran a passive OAuth 2.1 audit on 277 public MCP servers. This week the scanner got four new passive checks that read response headers and authorization server metadata without a single extra request. I re-scanned the same host list. 130 were reachable in both sweeps.\n\nOne number stuck out.\n\nHEADERS-001 fires when the initialize response is missing one of four standard transport-security headers:\n\n121 of the 125 servers that were reachable this week trigger at least one. That is 96.8 percent. Only 4 servers had clean transport-security headers.\n\nThese are not expensive checks. Each header is one line of configuration on the reverse proxy or in the response code. The reason the count is this high is that nobody is used to treating an MCP endpoint as a web service that lives in a browser threat model. Agents do not live in browsers today, but the endpoint is still reachable from one.\n\n| Check | Last week | This week | \n|---|---|---|\n| RESOURCE-001 (Protected Resource Metadata missing) | 0 | 6 | \n| ISS-001 (RFC 9207 iss parameter not advertised) | 0 | 6 | \n| AUTH-007 (invalid bearer returns wrong HTTP status) | 0 | 3 | \n\nThree low-cost fixes, each catching a narrower class of servers. The counts are low because the servers these catch are specific: RESOURCE-001 only on servers that advertise OAuth and still omit the Protected Resource Metadata document, ISS-001 only on metadata clean enough to read, AUTH-007 only on servers that bother to reject an invalid token at all. The code did not get worse. The scanner got a new eye.\n\nNo new check fires on code these servers did not already have. The grade shift is only the four passive signals that used to be invisible to the scanner.\n\n| Host | Last week | This week | \n|---|---|---|\n| api.githubcopilot.com/mcp | A | C | \n| mcp.sentry.io | A | C | \n| crashstory.com/mcp | A | C | \n| mcp.supabase.com/mcp | A | B | \n| mcp.sentry.dev/mcp | A | B | \n| mcp.deepwiki.com/mcp | A | B | \n| mcp.semgrep.ai/mcp | A | B | \n| mcp-server.egnyte.com/sse | A | B | \n| game.spacemolt.com/mcp | A | B | \n| mcp.roundtable.now/mcp | D | F | \n\nThe pattern is consistent: HEADERS-001 for almost everyone, plus RESOURCE-001 or AUTH-007 on top.\n\nThese numbers are not a benchmark of MCP server quality. They are a measurement of what four cheap checks catch on a public cohort today. A grade is an aggregate: a server with strong authentication and weak transport headers ends up next to one with weak authentication and strong transport headers. The report page for each host is where the details live.\n\nThe sweep also did not run the four new active checks against anyone. Those probes register clients and send crafted `/authorize` requests. They are safe against your own server and rude against someone else's. Opt-in only.\n\n```\nnpx -y @patchbay-nebius/agent audit https://mcp.example.com/mcp\n```\n\nNo credentials, no flags, no account. Eight-second scan, report page public for 90 days.\n\nFull write-up with every check explained on the original blog: [patchbay-mcp.dev/blog/mcp-transport-security-one-week-later](https://patchbay-mcp.dev/blog/mcp-transport-security-one-week-later)", "url": "https://wpnews.pro/news/one-week-later-97-of-tracked-mcp-servers-trip-a-new-transport-security-check", "canonical_source": "https://dev.to/godsmasher/one-week-later-97-of-tracked-mcp-servers-trip-a-new-transport-security-check-1fhn", "published_at": "2026-11-12 08:46:39+00:00", "updated_at": "2026-11-12 08:51:10.520351+00:00", "lang": "en", "topics": ["ai-agents", "agent-protocols", "ai-safety", "developer-tools"], "entities": ["MCP", "GitHub Copilot", "Sentry", "Supabase", "DeepWiki", "Semgrep", "Egnyte", "Patchbay Nebius"], "also_reported_by": [], "alternates": {"html": "https://wpnews.pro/news/one-week-later-97-of-tracked-mcp-servers-trip-a-new-transport-security-check", "markdown": "https://wpnews.pro/news/one-week-later-97-of-tracked-mcp-servers-trip-a-new-transport-security-check.md", "text": "https://wpnews.pro/news/one-week-later-97-of-tracked-mcp-servers-trip-a-new-transport-security-check.txt", "jsonld": "https://wpnews.pro/news/one-week-later-97-of-tracked-mcp-servers-trip-a-new-transport-security-check.jsonld"}}