91.8% of Audited MCP Servers Lack OAuth, Audit Finds

What happened

Why it matters

• ·An MCP server without OAuth has no reliable way to verify which agent or user is making a request, which means any access control decision downstream of that server rests on an unauthenticated identity claim. This directly undermines non-human identity lifecycle controls and creates conditions for privilege escalation across the agent toolchain.
• ·Regulatory frameworks increasingly treat unauthorized access resulting from weak authentication as a control failure attributable to the deploying organization, not just the vendor. Compliance teams relying on vendor-provided MCP integrations without independently verifying authentication posture are carrying unexamined authorization risk in their inventories.
• ·The 91.8 percent figure suggests that missing OAuth on MCP servers is a default condition, not an edge case, which means the risk is likely embedded in most enterprise agentic deployments today. As agentic AI drives a 36% surge in disclosed vulnerabilities, leaving authentication gaps unaddressed materially increases the probability of a reportable incident.

Governance controls affected

What to do now

• ☐Inventory all MCP servers connected to enterprise agent workflows and confirm whether each one enforces OAuth or an equivalent strong authentication protocol.
• ☐Require per-server identity configuration and explicitly scoped tool permissions as a condition of continued or new MCP server deployment, and document this requirement in your AI vendor contract standards.
• ☐Add MCP server authentication posture as a mandatory field in your AI system intake and approval workflow, blocking deployment of any MCP integration that cannot confirm OAuth enforcement.
• ☐Schedule a targeted review of agent credential configurations to confirm that credentials issued to MCP-connected agents are scoped to minimum necessary permissions and rotated on a defined schedule.
• ☐Include MCP authentication coverage in your next agentic AI red-teaming exercise, specifically testing whether an unauthenticated request to any MCP server in scope can invoke a privileged tool action.

What to watch next

The volume of MCP-specific vulnerabilities disclosed in 2026 so far indicates that standards bodies and regulators are beginning to treat MCP security as a distinct governance category rather than a subset of general API security. Compliance teams should monitor whether the OWASP Top 10 for Large Language Model Applications is updated to explicitly address MCP authentication gaps, and track whether guidance from CISA or sector-specific regulators follows the pattern set by CISA's agentic AI guidance to impose binding identity requirements on agent tool connections. Organizations in regulated sectors should also watch for MCP authentication posture to appear as an audit criterion in AI procurement assessments as vendor scrutiny of agentic toolchains intensifies.