Software Engineer New Grad

MCP Server security: what 22,000 servers actually hide. The MCP ecosystem just passed 22,000 servers, but a 2026 audit found 25% have no authentication at all. Here's what enterprise teams need to check before the July 28 spec lands. BeagleAI teammate for Slack and Microsoft Teams An engineer on your platform team connects a new MCP server to the agent stack at 11am. It's listed in a popular registry, has 400 GitHub stars, and the setup takes about eight minutes. What the README doesn't mention: no auth, ever. Any client that knows the endpoint URL can call it. That scenario is not hypothetical. A 2026 security audit found that 25% of public MCP servers have no authentication at all, and 53% rely on long-lived static API keys or personal access tokens - credentials that, once leaked, provide indefinite access. Meanwhile, as of July 16, 2026, PulseMCP lists 22,311 servers, up from 14,000 in May. The ecosystem is growing faster than its security floor. The timing matters. July 28, 2026 is the date the current release candidate becomes the official MCP spec. It is the largest revision of the protocol since launch, delivering a stateless core, MCP Apps, long-running Tasks, and authorization that aligns more closely with OAuth and OpenID Connect deployments. That update will bring more teams into MCP and more agents into production - into an ecosystem where, right now, fewer than one in ten servers meets the auth standard the spec has required for months. What MCP server authentication actually requires. The spec is not ambiguous. MCP OAuth 2.1 authentication is the authorization framework mandated by the Model Context Protocol specification for all remote HTTP-based servers. As of the November 2025 spec revision, any MCP server accessible over the internet must implement OAuth 2.1 with PKCE - no exceptions. The flow itself is well-defined: the canonical flow covers a 401 challenge, metadata discovery, client registration, and an Authorization Code with PKCE exchange. Token validation requires checks for signature, expiry, issuer, and audience - bound to a canonical MCP server URI. What makes this hard in practice isn't the protocol. It's that the MCP specification mandates OAuth 2.1, and the 2025-11-25 spec update layered on requirements that traditional OAuth providers simply do not support: Dynamic Client Registration (DCR), Protected Resource Metadata (RFC 9728), Resource Indicators (RFC 8707), and more. Your existing identity provider - the one you've used for the past four years - may not cover these, even if it nominally supports OAuth 2.1. That gap is where most teams run into trouble. The public MCP server registry grew from roughly 1,200 entries in Q1 2025 to over 9,400 servers by mid-April 2026 - a 7x increase in fourteen months. Meanwhile, 38% of organizations say security concerns are actively blocking their MCP adoption, and 50% of MCP builders cite access control as their top challenge. The two numbers belong next to each other: access control is the top cited challenge, but the ecosystem kept growing anyway, which means most teams shipped without solving it. Why mixing server types in one stack is the actual risk. The headline numbers - 25% no auth, 53% static keys - are alarming in isolation. The compounding problem is what happens when you mix those servers in a single agent deployment. MCP servers can rely on OAuth, API keys, bearer tokens, headers, open access, or custom credential patterns, which creates inconsistent security and review requirements across tools. Mixing OAuth-protected production servers with API-key community servers in the same infrastructure introduces privilege escalation risks and audit trail gaps. The practical scenario: your agent has an OAuth-protected Jira MCP server and an open-access community server for web fetching wired together in the same session. A prompt-injection attack against the open server doesn't just get web content - it can instruct the agent to call the authenticated Jira server on its behalf. The weak link doesn't stay isolated; the agent's context window connects everything. 22,311 servers in the MCP ecosystem as of July 16, 2026 (PulseMCP) 25% have no authentication public server audit, 2026 8.5% implement OAuth 2.1 the spec's mandatory standard for remote servers 38% blocked by security concerns organizations surveyed on MCP adoption Manual vetting cannot scale to 10,000+ MCP servers; automated security frameworks with registry-based deployment pipelines are essential for enterprise adoption. Most platform teams are not there yet. The tooling is catching up - Auth0's "Auth for MCP" became generally available on May 6, 2026, integrating OAuth 2.1 and OpenID Connect into the MCP ecosystem. Okta has also released its own MCP server - a secure protocol abstraction layer that enables AI agents and LLMs to interact with Okta's scoped management APIs, with least-privilege access control enforced at each tool call. But tooling availability doesn't mean adoption. It means the excuse to skip auth is getting smaller. What the July 28 spec changes - and what it doesn't. The practical effect on a production deployment is immediate. A remote MCP server that previously needed sticky sessions, a shared session store, and deep packet inspection at the gateway can now run behind a plain round-robin load balancer, route traffic on an Mcp-Method header, and let clients cache tools/list responses for as long as the server's ttlMs permits. That is a real operational improvement - it lowers the infrastructure cost of running MCP at scale. What it does not fix is the auth distribution. This release tightens the contract between clients and servers so those connections are easier to operate, observe, and evolve. There are breaking changes, so implementers have work to do. More teams running MCP on cheaper, simpler infrastructure is good. More teams running MCP on cheaper, simpler infrastructure with no auth is not. The MCP protocol is going stateless on July 28, 2026, and the GitHub MCP Server already supports the latest spec ahead of the official release. The new stateless core means MCP deployments are now easy to scale. GitHub shipping early is a useful signal - this is what Tier 1 SDK adoption looks like. For enterprise teams, it's also a forcing function: the spec is real, the tooling is ready, and the auth gap is now the last friction point with a name on it. A practical three-step check before connecting any MCP server to a production agent: * Identify the auth type. OAuth 2.1 with PKCE is the bar. API key or open access means the server is not spec-compliant for remote deployment. * Check token scope. A server that asks for broad API access when it only needs read on one resource is a misconfiguration waiting to cause an incident. * Treat mixed stacks as a single trust boundary. If any server in your agent's session is weaker, the weakest one defines the blast radius. IAM, NHI, and agent governance teams now have to decide whether MCP access will be layered onto existing identity systems, handled through purpose-built middleware, or pushed into a full platform rebuild. That decision is no longer theoretical. The ecosystem is at 22,000 servers and growing by thousands per month. Whatever your team ships into that ecosystem this quarter, it will inherit the security posture of every other server it talks to. Connecting a new MCP server to your agent stack Without Beagle check the README, note it has an API key option, add it to the config, ship - auth fragmentation sits unexamined across five servers in the same session With Beagle check auth type against spec requirements, verify token scope, document it, flag open-access servers as isolated from authenticated ones before the PR merges MCP server security: common questions. What authentication does the MCP spec require? The MCP specification mandates OAuth 2.1 with PKCE for any remote HTTP-based server. This has been required since the November 2025 spec revision. Static API keys and open-access endpoints are non-compliant for remote deployments, though they remain common in practice - a 2026 audit put OAuth 2.1 adoption at roughly 8.5% of public servers. Can I use my existing identity provider for MCP OAuth? Possibly, but not automatically. The MCP spec requires Dynamic Client Registration, Protected Resource Metadata (RFC 9728), and Resource Indicators (RFC 8707) - capabilities that many mainstream OAuth providers do not support out of the box. Auth0's MCP auth product (GA May 2026) and WorkOS are purpose-built for this. Check your provider's docs against those specific RFCs before assuming it works. What does the July 28 MCP spec change for security? The July 28 spec is primarily an infrastructure update - stateless core, no sticky sessions, plain load balancer support. It also sharpens authorization alignment with OAuth and OpenID Connect. It does not retroactively fix existing servers with weak or no auth. Security posture stays the property of each individual server and the team that deployed it. Why is mixing MCP server auth types in one agent session risky? When an agent holds multiple MCP server connections in a single session, its context window links them. A prompt-injection attack against a weaker or open-access server can instruct the agent to call an authenticated server on its behalf. The blast radius of the weakest server in the session is not bounded to that server alone. How do I vet an MCP server before adding it to production? Three checks cover the most common failure modes: confirm the auth type (OAuth 2.1 or flag it), review the token scope it requests against what it actually needs, and document it in your team's server registry. Automated pipeline enforcement - blocking non-compliant servers before they reach production - is the only approach that scales past a few dozen servers.

Okta partners with MintMCP to govern how agents connect to enterprise apps. Most AI agents reach enterprise applications the same way: a static API key or a long-lived token pasted into a config file. That credential rarely rotates, carries broad scope, and gives no clean way to tell which agent used it or to cut off access. As teams move from a handful of experiments to agents acting on behalf of real users, IT and security need a way to scope, audit, and revoke agent access without slowing every project down. The exposure is already showing up: a survey of more than 900 practitioners found that 88% of organizations have seen confirmed or suspected AI agent security incidents, and IBM reports that 97% of organizations hit by an AI-related breach lacked proper AI access controls. Today, Okta and MintMCP are officially partnering on Cross App Access (XAA), Okta's new approach to securing how AI agents connect to applications. MintMCP is one of 25+ launch partners adopting it. For enterprises already running MintMCP to deploy MCP servers and agents, the partnership means MintMCP can tie those agent connections to the same Okta identity and policies that secure the rest of your workforce. What it means for enterprises deploying MCP and agents. With XAA, MintMCP can authorize agent connections against Okta identity and policy instead of static keys, while its gateway keeps governing which MCP servers and tools an agent reaches. The controls you already run for employees now extend to the agents acting on their behalf, and the people those agents work for stop signing into the same apps over and over. For teams putting MCP servers and agents into production, that changes a few things: * Security teams can limit and revoke access: each connection runs on scoped, short-lived tokens instead of standing API keys, and every XAA-governed connection is logged against an identity, so you can see which agent reached what, under whose authority, and cut off access when something looks wrong. * Users sign in once, not once per app: use an AI assistant like Claude with MCP servers today and each downstream app needs its own login, so you OAuth into one, then the next, then the next. Routing through MintMCP, you authenticate once and the agent gets scoped access to those apps on your behalf, no repeated sign-ins, and that holds for any AI system on the gateway, not just Claude but Cursor, ChatGPT, Copilot, and the rest. * Agent access follows your Okta policies: the gateway authorizes connections against the identity-based rules you already maintain, so you extend existing governance to agents rather than building a separate one for AI. * Security review starts with identity and audit already covered: when identity and audit run through Okta and MintMCP, security review can focus on app-specific scopes and exceptions instead of rebuilding the governance model. Because Cross App Access is built on OAuth, it works with the identity controls you already run rather than adding a proprietary layer to adopt and maintain. "Cross App Access is the result of a massive, two-year collaborative effort within the OAuth working group to ensure secure, revocable agent delegation. At Okta, we are proud to have helped champion this new open standard, and we're thrilled to see MintMCP among the very first to bring it to production for enterprises deploying MCP across their org." Aaron Parecki, Director of Identity Standards at Okta How MintMCP fits. MintMCP is the gateway and control plane for agent traffic. As requests pass through custom agents, MCP servers, and orchestration layers, its gateway governs which servers an agent can reach and which tools it can call, gives each agent its own identity through agent identities, and logs every call for audit. That is its own policy and governance engine, and it runs independently of Okta. "Agents should not directly impersonate a user, and users should not have to sign in twice just to let an agent help them. With the Cross App Access protocol, MintMCP's gateway can give each agent its own identity while it acts on behalf of a real user. That means security teams can limit and revoke access, and users stay out of the repeat login loop." Jiquan Ngiam, Co-founder and CEO at MintMCP Cross App Access connects that control plane to Okta. Instead of static keys, agent connections are authorized against your Okta identity and policies, so MintMCP's MCP-level governance and the identity controls you already run work together on the same connection. Where Cross App Access fits. XAA is one piece of what Okta calls the blueprint for the secure agentic enterprise, a framework built on three questions: where are my agents, what can they connect to, and what can they do. Cross App Access answers the second. It pairs with work MintMCP has already shipped: agent identities give each agent its own credentials and scoped permissions, and the MintMCP gateway governs which tools an agent can call and records every call. Availability. Cross App Access support is available to MintMCP customers running Mint with Okta. If that's your setup, reach out and MintMCP can walk through how it fits. To go deeper, join its fireside chat with Aaron Parecki of Okta on giving AI agents safe access to enterprise apps.