Exposed MCP Servers: Bind to Localhost, Require Auth, Audit Tools
A short guide for people who build apps with AI: find your MCP servers, close the ones listening on every interface, require a token, and cut the tool list to what you use.
Founder, Newly
Published Last updated
An MCP server that listens on every network interface and answers without a login can be used by anyone who can reach it. Bind it to 127.0.0.1 unless remote access is the point, validate the Origin header, require a token on every request, then list its tools and remove the ones your app does not need. The sources below were checked on October 24, 2026.
What does the MCP specification require of a server?
MCP, the Model Context Protocol, lets an AI client call tools on a server: query a database, read files, call an API. The specification revision of July 28, 2026 sets the rules below for servers that use HTTP.
| Topic | What the specification says | Source |
|---|---|---|
| Origin header | Servers must validate it on all incoming connections, and answer 403 when it is present and invalid. | Streamable HTTP |
| Bind address | When running locally, servers should bind to 127.0.0.1 rather than 0.0.0.0. | Streamable HTTP |
| Authentication | Servers should implement proper authentication for all connections. Authorization as a whole is optional. | Streamable HTTP; Authorization |
| Tokens over HTTP | A token goes in the Authorization header of every request. Missing or invalid tokens get a 401. The server must check that the token was issued for it. | Authorization |
| stdio servers | Should not follow the HTTP authorization flow and take credentials from the environment instead. | Authorization |
| Tool annotations | Clients must treat them as untrusted unless the server is trusted, and there should be a human able to deny tool calls. | Tools |
Reading this table
Must and should are the specification's own words, checked on October 24, 2026. Because authorization is optional, nothing forces a server to ask for a login. Whether yours does is a setting you check yourself.
Where does an app builder meet an MCP server?
A React Native app on a phone does not host an MCP server. MCP shows up around the app, in three places:
- Your build tools. Editors and coding agents connect to servers such as a database server that lets an assistant run queries. These usually run on your own computer.
- A server your backend runs. If an AI feature in your app calls tools, someone set up an MCP server for it, often over HTTP and often on a public host.
- Developer tools you installed. Inspectors, bridges and gateways are MCP software too, and they have had their own advisories.
Newly builds a real iPhone and Android app with React Native and Expo, and you can download your code or connect your own repository. That lets you search the project and its config for the settings below. The diagram shows what sits between a caller and your data.
What went wrong with exposed MCP servers in 2026?
These records are a sample of 2026 advisories, not a count of how many servers are exposed. Dates are as shown on each advisory page, checked on October 24, 2026.
| Software | Weakness | Fixed in | Published |
|---|---|---|---|
| mcp-router (CVE-2026-81094) | CLI served on every interface, token only if a flag was passed. CVSS 9.3. | 0.6.3 | Aug 27, 2026 |
| mysql-mcp-server (CVE-2026-59971) | SSE mode bound to 0.0.0.0 by default, no auth, no Origin or Host validation. stdio mode unaffected. | 0.4.2 | Jun 21, 2026 |
| DBHub (CVE-2026-61742) | HTTP transport relied on an Origin and Host comparison that DNS rebinding defeats. CVSS 9.3. | 0.22.5 | Jun 24, 2026 |
| mcp-atlassian (CVE-2026-27826) | Requests without an Authorization header could make the server send outbound requests. CVSS 8.2. | 0.17.0 | Feb 24, 2026 |
| MCP Inspector | With auth switched off by a dev flag, Origin validation failed open when no Origin was sent. CVSS 7.5. | 1.0.3 | Oct 21, 2026 |
| DocumentDB MCP Server (CVE-2026-18954) | Authenticated clients could write through a connection set to read-only. | 1.0.12 | Aug 5, 2026 |
Five lessons for your own setup:
- A default of all interfaces turns a developer tool into a public service. The mcp-router fix changed the default to loopback and made a token mandatory for any other address.
- Localhost is not a wall. The specification says that without these protections, attackers could use DNS rebinding to reach local MCP servers from remote websites. The DBHub advisory recommends an allowed-hosts policy, an allowed-origins policy and a token before any method runs.
- A flag that disables auth in development is a flag that can reach production. Search your config for anything named like it.
- A read-only switch is a setting inside the server. The AWS bulletin shows one failing, so also give the credential behind the tool only read access.
- Check the version, not only the config. Compare your lockfile with the fixed versions above.
How do I find out who can reach my MCP server?
Start with the address it listens on. On a computer you control, run lsof -nP -iTCP -sTCP:LISTEN and read the address column. On a hosting platform, find the host or bind setting in the service config. Then compare it with the table.
| What you see | What it means | What to do |
|---|---|---|
| 127.0.0.1 or ::1 | Only programs on that computer connect, including a browser tab. | Keep it. Still validate Origin and Host, and use a token. |
| 0.0.0.0, :: or * | Every network interface: office Wi-Fi, a shared network, and any public address the machine has. | Change to 127.0.0.1. If remote access is the point, add auth before you open it. |
| A public hostname, proxy or tunnel | Anyone who learns the URL can send a request. | Require the token at the MCP server itself, not only at the proxy. |
| Cannot tell (container, platform) | Unknown. | Read the platform's port and network settings, then run the no-token test below. |
The no-token test: send one request without an Authorization header to your own MCP URL, from a phone on mobile data. A 401 with a WWW-Authenticate header is what the specification describes. A 200 means the server answered a stranger, so mark that item detected.
A scan can add an outside view of the domain you own. The red.run.cloud check list includes services reachable from the internet and unauthenticated routes. MCP endpoints are not on that list by name, so read a result as a lookup of what your site serves.
How do I require auth and audit the tools?
Require a token on every request
Vercel's MCP guide wraps a handler in withMcpAuth with required: true, so requests without a valid token receive 401 and requests lacking a scope receive 403. Its example compares against a demo token for local testing and says that production should verify issuer, audience, expiration and granted scopes with your authorization server. Whatever stack you use, copy that shape: verify on the server, on every request, for this server only.
Audit the tool list
- Write down every tool the server lists. Delete the ones your app or workflow does not call.
- For each tool, name the credential behind it and what that credential can read or change. A tool that only reads should hold a read-only credential.
- Keep read tools and write tools apart, so a call to the first can never reach the second.
- Remember that tool descriptions can carry instructions. OWASP lists tool misuse among its top agentic risks, and the specification says clients must treat tool annotations as untrusted unless the server is trusted. See also the OWASP agentic list.
Treat your editor's servers the same way
Supabase's guidance for its MCP server is a good template: scope it to one project, connect to production only when the task requires production evidence, use read-only mode for monitoring, keep manual approval of tool calls on, and do not give it to customers or end users. It names prompt injection as the main risk, which ties back to the chat feature check in the 15-minute app check. Anthropic's Claude Code docs say to verify you trust each server before connecting it, and that servers fetching external content expose you to prompt injection.
If a server was open and held keys, treat those keys as exposed until you rotate them. Follow the rotation order for app teams, and read what to do about a leaked AI key. The same exposure pattern in a gateway is covered in the internal AI gateway lesson, and poisoned packages in AI tooling supply chain attacks. An endpoint anyone can call can also spend the AI usage behind it, and AI inside a Newly app uses credits, so closing the endpoint also protects that balance.
Where do you stand?
Everything starts as unknown, because that is what an unchecked item is. Move an item to confirmed only when you hold the evidence listed under it.
Your MCP exposure check
- Detected: You found the problem.
- Unknown: Not checked yet, or the check could not tell.
- Confirmed by owner evidence: You checked and kept the proof.
Your answers stay in this browser tab. Nothing is saved or sent.
Frequently asked questions
Does binding to localhost mean nobody else can reach my MCP server?
No. Binding to 127.0.0.1 keeps other machines out, but other programs on the same computer can still connect, and the MCP specification warns that without Origin validation a remote website can use DNS rebinding to reach a local server. Keep the Origin and Host checks and require a token as well.
Do I need OAuth for an MCP server only I use?
The specification makes authorization optional. For a server on stdio it says to take credentials from the environment instead. For an HTTP server, it says authorization must be sent with every request and that invalid or missing tokens get a 401. At minimum, verify a token on every request at the server itself.
Does my Expo app need an MCP server?
Not for a typical app. The app on the phone calls your backend. MCP matters if you give an AI feature tools to call, or if you connect assistants to your database or hosting while you build. Those servers are the ones to check.
Is it fine to connect a database MCP server to production?
Supabase advises connecting to a production project only when the task requires production evidence, using read-only mode, scoping the server to one project, and not giving it to customers or end users. Treat the same advice as a baseline for any database server.
I found an open MCP server that had been up for weeks. What now?
Treat exposure as unknown rather than ruled out. Close it or add auth, check logs for requests you do not recognize, update to a fixed version, and rotate every credential the server could read. The rotation guide linked in the body lists the order to work in.
Can a scan tell me if my MCP server is exposed?
A scan works from outside and reports what it detected. The free scan on red.run.cloud reads your stack and matches versions to known vulnerabilities. The full scan sends an AI red team that lists the routes and services it can reach. Neither can see a server that never answers a public request.
Sources
- Streamable HTTP transport, security and endpoint, Model Context Protocol, spec 2026-07-28
- Authorization, Model Context Protocol, spec 2026-07-28
- Tools, Model Context Protocol, spec 2026-07-28
- CVE-2026-81094, mcp-router (GHSA-g448-x63h-m2m3), GitHub Advisory Database
- CVE-2026-59971, mysql-mcp-server (GHSA-rqfv-2mw9-78g2), designcomputer/mysql_mcp_server security advisories
- CVE-2026-61742, DBHub (GHSA-fm8p-53ww-hf6w), GitHub Advisory Database
- CVE-2026-27826, mcp-atlassian (GHSA-7r34-79r5-rcc9), GitHub Advisory Database
- Missing authentication in MCP Inspector (GHSA-wmjf-2m46-2352), modelcontextprotocol/inspector security advisories
- CVE-2026-18954, DocumentDB MCP Server, bulletin 2026-076, AWS Security Bulletins
- Security best practices for Supabase MCP, Supabase docs
- Deploy MCP servers to Vercel, enabling authorization, Vercel docs
- Connect Claude Code to tools via MCP, Anthropic docs
- OWASP Top 10 for Agentic Applications, OWASP GenAI Security Project