{"slug": "the-schrodinger-identity-of-mcp-37-of-officially-registered-endpoints-don-t-know", "title": "The Schrödinger Identity of MCP: 37% of Officially Registered Endpoints Don't Know Who You Are", "summary": "A security audit by Correctover, led by Guigui Wang, found that 37% of 57 servers advertising Streamable HTTP endpoints in the official MCP registry complete the protocol handshake with no authentication, and 76% of those return their full tool inventory to callers who never performed the handshake at all. Controlled experiments against the official TypeScript SDK showed session IDs are never bound to the authenticated subject, letting a leaked victim session ID execute tools under the victim's identity and be terminated with a plain DELETE — a flaw the team calls the \"Session-as-Identity antinomy.\" The researchers say the spec (2025-06-18) never requires binding, and note a Ruby SDK CVE and the merged SEP-2567 sessionless proposal confirm the issue is known upstream.", "body_md": "*Guigui Wang — Correctover · 2026-11-12 · raw data & replayable scripts: [github.com/DSHCorrectover/mcp-session-audit](https://github.com/DSHCorrectover/mcp-session-audit)*\n\n**TL;DR**: We passively probed 57 servers advertising Streamable HTTP endpoints in the official MCP registry — one benign `initialize` each, no injection, no state change. **37% complete the handshake with zero authentication. 76% of those return their full tool inventory to callers who never performed the protocol handshake at all.** One advertising-tech endpoint exposes 35 account-level tools (mailbox listing, account lookup, campaign management) to any `curl` one-liner. The deeper problem is architectural, and we named it: **the Session-as-Identity antinomy**.\n\n| Class | Share | What it means | \n|---|---|---|\n| Anonymous handshake OK | **37%** | Anyone can enumerate tools. No credential, no registration, no subject concept. | \n| Zero-handshake tool inventory | **76% of the above** | No `initialize` needed either — a bare`tools/list` POST works. | \n| OAuth-gated (correct 401 + RFC 9728 metadata) | 21% | The minority doing it by the book. | \n| Registered-but-unreachable | 16% | URLs that no longer serve standard traffic — a registry-hygiene footnote. | \n\nEvery call was read-only, carried an explicit `X-Audit-By: Correctover` header, and is replayable from our repo. We named no one in this post; responsible disclosure to the affected operators comes first.\n\nAn MCP server is not a website. Its tool list is a machine-readable contract that LLM agents consume and *execute*. A tool named `get_account` behind no authentication is not a missing login page — it is an unauthenticated data-retrieval API wearing an agent-friendly protocol. The ecosystem's story so far has been about MCP servers being *easy to build*; our data says they have been equally easy to expose.\n\nFor servers that *do* implement authentication, we ran controlled experiments against the official TypeScript SDK (self-operated targets, our own tokens, our own sessions). The result: **the session ID and the authenticated subject are never bound.** With a valid attacker token and a leaked victim session ID, tools execute inside the victim's session, and a plain `DELETE` terminates it — the victim's own valid token then bounces off a 404. We call this the **Session-as-Identity antinomy**: MCP conflates a *routing identifier* (\"which context\") with a *subject identifier* (\"who\"). The spec (2025-06-18) never requires binding; the reference implementation validates sessions by string equality; a Ruby SDK CVE and the protocol's own SEP-2567 (sessionless MCP, merged Final) confirm the class is known upstream.\n\nThree verdicts cover the whole ecosystem:\n\nWe sell the verdict, and you can re-verify it yourself.\n\n*Method, per-endpoint raw data, probe scripts, and the full test protocol: [github.com/DSHCorrectover/mcp-session-audit](https://github.com/DSHCorrectover/mcp-session-audit). Errors and corrections welcome — we publish our own error log with the data.*", "url": "https://wpnews.pro/news/the-schrodinger-identity-of-mcp-37-of-officially-registered-endpoints-don-t-know", "canonical_source": "https://dev.to/correctover/the-schrodinger-identity-of-mcp-37-of-officially-registered-endpoints-dont-know-who-you-are-466f", "published_at": "2026-11-12 07:14:11+00:00", "updated_at": "2026-11-12 07:21:21.210615+00:00", "lang": "en", "topics": ["ai-agents", "agent-protocols", "ai-safety", "ai-tools"], "entities": ["Correctover", "Guigui Wang", "Model Context Protocol", "TypeScript SDK", "SEP-2567"], "also_reported_by": [], "alternates": {"html": "https://wpnews.pro/news/the-schrodinger-identity-of-mcp-37-of-officially-registered-endpoints-don-t-know", "markdown": "https://wpnews.pro/news/the-schrodinger-identity-of-mcp-37-of-officially-registered-endpoints-don-t-know.md", "text": "https://wpnews.pro/news/the-schrodinger-identity-of-mcp-37-of-officially-registered-endpoints-don-t-know.txt", "jsonld": "https://wpnews.pro/news/the-schrodinger-identity-of-mcp-37-of-officially-registered-endpoints-don-t-know.jsonld"}}