# Unauthenticated MCP tool invocation

MCP/agent HTTP tool routes reachable without auth middleware, bearer checks, or signature validation

_Area: AI and LLM app security. Seen in 4 disclosed reports; latest 2026-07-31. Updated 2026-10-24._

## How it works
An MCP or agent server exposes an HTTP transport that accepts JSON-RPC (or REST) requests and dispatches them straight to tool handlers. The code assumes the network boundary or a fronting proxy provides authentication, so the transport itself never checks identity. Any client that can reach the port can list and invoke tools, and those tools run with the server's own credentials and privileges. The broken assumption: "reachable" is treated as "trusted."

## Where it shows up
- HTTP transport constructed with no auth option, or a config object with no auth/security field at all [E1](https://bugbountylibrary.com/r/ghsa%3AGHSA-p7w7-4929-vpj5.md)[E2](https://bugbountylibrary.com/r/ghsa%3AGHSA-j4f3-55x4-r6q2.md).
- Request body parsed and forwarded to the dispatcher before any identity check [E1](https://bugbountylibrary.com/r/ghsa%3AGHSA-p7w7-4929-vpj5.md)[E2](https://bugbountylibrary.com/r/ghsa%3AGHSA-j4f3-55x4-r6q2.md).
- A security module (API-key policy, approval gate) exists in the package but is never imported or called by the transport [E2](https://bugbountylibrary.com/r/ghsa%3AGHSA-j4f3-55x4-r6q2.md).
- Server binds to `::` or `0.0.0.0` by default, widening exposure [E2](https://bugbountylibrary.com/r/ghsa%3AGHSA-j4f3-55x4-r6q2.md)[E3](https://bugbountylibrary.com/r/ghsa%3AGHSA-892r-p3jq-jp24.md).
- Routes registered with no dependency, middleware, or bearer check; a wrong `Authorization` header is silently ignored rather than rejected [E3](https://bugbountylibrary.com/r/ghsa%3AGHSA-892r-p3jq-jp24.md).
- Sensitive tools (query execution, agent invocation) callable directly with the server's stored credentials [E1](https://bugbountylibrary.com/r/ghsa%3AGHSA-p7w7-4929-vpj5.md)[E3](https://bugbountylibrary.com/r/ghsa%3AGHSA-892r-p3jq-jp24.md).

## How to review
For every externally bound route, trace from socket accept to tool handler and confirm an authentication check runs on that path before dispatch. The invariant: no tool handler executes unless the request carries a verified identity, and a missing or wrong credential is rejected, not ignored. Check that any shipped security/approval module is actually wired into the request path, not merely present. Check default bind addresses and Host/Origin validation. For approval gates, confirm they fail closed on transports that cannot prompt.

## Variants seen
- Streamable HTTP MCP transport with no session, bearer, Host or Origin validation [E1](https://bugbountylibrary.com/r/ghsa%3AGHSA-p7w7-4929-vpj5.md).
- TypeScript MCP server whose config lacks auth and whose security manager is unwired [E2](https://bugbountylibrary.com/r/ghsa%3AGHSA-j4f3-55x4-r6q2.md).
- FastAPI agent deployment with unauthenticated routes bound to all interfaces [E3](https://bugbountylibrary.com/r/ghsa%3AGHSA-892r-p3jq-jp24.md).

## Why fixes fail
A prior advisory patched one generated deployment surface, but the core `agentos.py` routes stayed unauthenticated and the fix version still allowed remote invocation [E3](https://bugbountylibrary.com/r/ghsa%3AGHSA-892r-p3jq-jp24.md).

## Impact and severity
Remote invocation of privileged tools and agents under the server's credentials; high severity given default all-interface binding and no credential required [E1](https://bugbountylibrary.com/r/ghsa%3AGHSA-p7w7-4929-vpj5.md)[E2](https://bugbountylibrary.com/r/ghsa%3AGHSA-j4f3-55x4-r6q2.md)[E3](https://bugbountylibrary.com/r/ghsa%3AGHSA-892r-p3jq-jp24.md).

## Evidence
- E1: https://bugbountylibrary.com/r/ghsa%3AGHSA-p7w7-4929-vpj5.md
- E2: https://bugbountylibrary.com/r/ghsa%3AGHSA-j4f3-55x4-r6q2.md
- E3: https://bugbountylibrary.com/r/ghsa%3AGHSA-892r-p3jq-jp24.md