Topic starter
22/09/2026 3:43 pm
TL;DR: P0 Security reports that Model Context Protocol is shifting from tool discovery into the identity plane for AI agents, with a May 2026 study of 7,973 live remote MCP servers finding 40.55% exposed tools with no authentication and every OAuth-enabled server tested showing at least one flaw. Authorization, not connectivity, is now the control boundary that determines what agents can actually do.
Editorial analysis by NHI Mgmt Group, based on content published by P0 Security: “Nobody built MCP servers to hold identity. They do anyway.”.
By the numbers:
- A May 2026 measurement study of 7,973 live remote MCP servers found that 40.55% expose their tools with no authentication at all.
- More than 300 CVEs have been filed against MCP infrastructure to date.
Key questions
Q: What breaks when MCP servers do not require authentication?
A: When MCP servers do not require authentication, the access boundary disappears.
Q: Why do unvetted MCP servers create more risk than normal integrations?
A: Unvetted MCP servers can inherit broad tool reach while hiding what data they read, what they transmit, and what decisions they influence.
Q: What are the signs that an MCP authorization flow is failing in practice?
A: Common failure signals include mismatched redirect URIs, missing PKCE parameters, stale authorization codes, unsupported protocol versions, and tokens accepted without scope or audience checks.
Practitioner guidance
- Govern MCP servers as identity infrastructure Classify each server as a resource server in your identity perimeter and require explicit ownership, scope, and review for any server that can authorise agent actions.
- Inventory every agent-reachable MCP server Build a live inventory of servers, connected agents, and exposed tools so that unsanctioned authority can be removed before it becomes embedded in workflows.
- Refuse static keys for production agents Require OAuth 2.1 with resource indicators and short-lived, caller-bound credentials instead of shared secrets that turn the server into the de-facto identity.
Bottom line: MCP is no longer just a tool-discovery layer. In practice, it is becoming the authorisation plane that governs what AI agents can do.
What's in the full article
P0 Security's full article covers the operational detail this post intentionally leaves for the source:
- The full measurement-study breakdown behind the 7,973-server sample and the 40.55% unauthenticated figure
- Discussion of OAuth-enabled server flaws, including why the tested servers still failed security checks
- Examples of concrete MCP deployment patterns that turn the server into an identity issuer
- Recommendations for treating MCP servers as governed identity infrastructure in production
👉 Read P0 Security's analysis of why MCP servers are becoming the identity plane for AI agents →
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 5 days ago by NHI Mgmt Group
22/09/2026 3:43 pm
MCP servers are becoming a blended identity layer, not just a transport for tools. The protocol now decides who can call what, under which scopes, and with which credentials, so the server is functioning as an authorisation broker in the middle of agent activity. That means identity governance has to move from the agent alone to the server-agent boundary. Practitioners should treat each MCP server as part of the identity plane, not a sidecar to it.
A few things that frame the scale:
- 24,008 unique secrets were exposed in MCP configuration files in 2025 alone, the protocol's first year of widespread adoption, according to the State of Secrets Sprawl 2026.
A question worth separating out:
Q: How should organisations govern MCP servers in identity programmes?
A: Organisations should inventory MCP servers like any other machine-facing access layer, then recertify exposed capabilities, remove unused tools, and keep state-changing actions tightly scoped. The goal is to reduce what an agent can even see as callable. That is a governance control, not just a software design preference.
👉 Read our full editorial: MCP servers are becoming the identity plane for AI agents
This post was modified 5 days ago by NHI Mgmt Group