tools/list endpoint exposed without authentication

What it is

Tool enumeration is the recon step of an MCP attack. Knowing what tools exist tells an attacker which prompt-injection payloads to send, which destructive operations to target, and which credentials might be reachable. Many MCP servers gate tool *invocation* but leave *listing* open under the assumption that knowing tool names is harmless — but it's exactly the information an attacker needs to plan.

Why it matters for MCP

MCP's HTTP transport is becoming common for hosted servers. Unlike stdio (which has implicit transport-level auth via the parent process), HTTP needs explicit authentication on every request. `tools/list` is the most-called method by clients — leaving it unauthenticated is the most common mistake.

Vulnerable example

from fastapi import FastAPI

from mcp.server.fastmcp import FastMCP

mcp = FastMCP("my-mcp")

app = FastAPI()

@app.post("/mcp")

async def handle_mcp(request: dict):

    # No auth — anyone can call tools/list and enumerate the surface.

    return await mcp.handle(request)

Secure example

from fastapi import FastAPI, Header, HTTPException

from mcp.server.fastmcp import FastMCP

mcp = FastMCP("my-mcp")

app = FastAPI()

@app.post("/mcp")

async def handle_mcp(request: dict, authorization: str = Header(None)):

    if not authorization or not authorization.startswith("Bearer "):

        raise HTTPException(status_code=401)

    return await mcp.handle(request)

How MCPSafe detects this

MCPSafe flags HTTP route handlers that parse `tools/list` requests without an `Authorization` header check, JWT decode, API key validation, or equivalent gating. Routes wrapped in middleware that checks bearer tokens are exempted.

See the full threat catalog for every documented detection.

Further reading

• MCP Spec — Authentication
• CWE-306: Missing Authentication for Critical Function