{
  "question": "We want to run a vendor's MCP server, or serve our own agent over MCP, in HTTP mode so a remote client or several people can reach it. Two 2026 advisories showed MCP servers whose HTTP mode ran tool calls with no authentication. Is an unauthenticated HTTP mode acceptable on a trusted network or on localhost, and what should we check before turning it on?",
  "slug": "is-it-safe-to-run-an-mcp-server-in-http-mode-without-authentication",
  "url": "https://www.rightshold.com/answers/is-it-safe-to-run-an-mcp-server-in-http-mode-without-authentication",
  "short_answer": "Not if the server holds credentials or can run commands. In HTTP mode, anyone who can reach the port can send a raw tools/call request, and the server runs it with whatever access it was given; the caller never needs the operator's credentials. The Dynatrace MCP server advisory GHSA-p7w7-4929-vpj5 (high, CVSS 3.1 7.5, tracked as CVE-2026-123811) found that --http mode did no authentication, session validation or Origin and Host checks in versions up to 1.8.7, so an unauthenticated caller could run execute_dql against the operator's Dynatrace tenant to read logs, security events and user sessions; the report puts the effective score at 9.3 when bound to 0.0.0.0. fast-agent's advisory GHSA-9vhv-g5hf-m7m7 (CVE-2026-102610) found fast-agent serve listening on 0.0.0.0:8000 with no authentication and no warning through 0.7.20; with --shell, an unauthenticated client could get the agent to run operating system commands. Both fixes moved the bind address to 127.0.0.1, and Dynatrace 2.0.0 also added bearer-token authentication and DNS rebinding protection. The MCP specification's Streamable HTTP rules say servers MUST validate the Origin header, SHOULD bind only to localhost when running locally, and SHOULD authenticate all connections. Localhost alone isn't enough: the Dynatrace report says loopback-only deployments still carry reduced but non-zero risk from DNS rebinding or a compromise on the same host.",
  "checklist": [
    "Use stdio when only one local client needs the server. A server the client starts as a subprocess has no network port for anyone else to reach.",
    "Before enabling HTTP mode, find out how the server authenticates callers: a required bearer token or OAuth. Don't run one that accepts tool calls without either when it holds credentials or shell access.",
    "Read the bind address in the startup log. Keep it at 127.0.0.1 unless remote clients must connect; 0.0.0.0 or a LAN address means anyone on that network can try the port.",
    "Upgrade: the Dynatrace MCP server to 2.0.0 or later (its repository was deprecated in 2.1.2 in favor of Dynatrace's remote MCP server and dtctl), and fast-agent-mcp to 0.7.21 or later.",
    "Probe it yourself without credentials: a JSON-RPC tools/list request with no Authorization header should get 401, and a request carrying an Origin you don't own should get 403, as the specification requires when Origin is present and invalid.",
    "Give the server the narrowest credential its tools need. An unauthenticated caller inherits exactly what the server holds, as the Dynatrace report's \"unauthenticated proxy\" description shows.",
    "Keep shell and write tools off any HTTP endpoint more than one person can reach. fast-agent prints a warning whenever --shell is enabled, with stronger wording for remote callers, and its docs recommend --instance-scope request for public or multi-user servers.",
    "For a remote server, put it behind a reverse proxy or gateway that authenticates and logs every request, and firewall the port to the clients that need it.",
    "Keep an inventory of every MCP server running in HTTP mode, with host, port, bind address, credential scope and owner, so a forgotten test server doesn't stay open."
  ],
  "sections": [
    {
      "heading": "What the Dynatrace and fast-agent advisories showed",
      "points": [
        "Dynatrace's advisory for @dynatrace-oss/dynatrace-mcp-server (published June 9, 2026, affected 1.8.7 and earlier, patched in 2.0.0) says the --http flag created a Streamable HTTP transport for each request with no bearer-token check, session token, Host allowlist or Origin allowlist, and handed the parsed body straight to it. In the version tested (1.8.5), two tools ran with no human-approval gate: execute_dql, which reads arbitrary Grail data such as logs, security events and user sessions with the operator's Dynatrace credentials, and create_dynatrace_notebook, which writes notebooks to the tenant. The report notes that send_event's approval call threw for an HTTP caller and so blocked that write.",
        "fast-agent's advisory (published July 22, 2026, affected fast-agent-mcp 0.7.20 and earlier, patched in 0.7.21, and reviewed into GitHub's advisory database on November 9, 2026) says fast-agent serve used HTTP on 0.0.0.0, port 8000, with authentication set to none and no warning. A client with no Authorization header completed initialize and tools/list. With --shell (-x, the flag in the README quickstart), the served agent had a local execute tool; the reporter showed a plain-language request leading gpt-4o-mini to run a command and return its output, and the server-side permission prompt didn't stop it in non-interactive serve mode. Without --shell, the advisory says, the caller still gets unauthenticated use of the operator's model and any configured MCP servers' tools.",
        "In both cases the attacker never needed the operator's secrets. The server used its own, which is the core risk of an unauthenticated HTTP mode: it turns the server into a proxy for whatever access it was given."
      ]
    },
    {
      "heading": "What the fixes changed, and what they left to you",
      "points": [
        "Dynatrace's 2.0.0 release (June 16, 2026) lists bearer token auth and HTTP server hardening, a default host of 127.0.0.1 \"to prevent unintended 0.0.0.0 exposure\", DNS rebinding protection in the HTTP transport, and a notice advising --http users to use Dynatrace's official remote MCP server. 2.1.0 (June 30) enforces an MCP_BEARER_TOKEN requirement, and 2.1.2 (July 20) deprecated the repository and points users to the remote MCP server and dtctl.",
        "fast-agent 0.7.21 moved the default host to 127.0.0.1 (pull request 828) and warns on remote binds and whenever --shell is on. Its docs say to use a non-loopback host only when remote clients should connect, and list Hugging Face OAuth for Spaces as the hosted authentication route. An independent test published by Agent Ops Guide reported that 0.7.21 added no token authentication, that an unauthenticated shell command still ran from loopback, and that with --host 0.0.0.0 it behaved like 0.7.20. Binding to loopback narrows who can reach the port; it doesn't authenticate anyone.",
        "The MCP specification's Streamable HTTP section lists the protections: validate the Origin header on all incoming connections and answer 403 Forbidden when it is present and invalid; when running locally, bind only to 127.0.0.1 rather than all interfaces; and implement proper authentication for all connections. Without them, it says, attackers could use DNS rebinding to interact with local MCP servers from remote websites."
      ]
    },
    {
      "heading": "How to check a server you already run",
      "points": [
        "Find it: list the listening ports on each host where agents run and match them to MCP processes, then note each bind address. Servers started for a demo or a test are the ones most likely to be left open.",
        "Probe it without credentials from another machine and from the same host: a tools/list request with no Authorization header that comes back 200 with a tool list means the HTTP mode is unauthenticated. Then repeat with an Origin header naming a site you don't control; a server following the specification refuses it with 403.",
        "Then look at what the process holds: its environment variables, tokens and the scopes behind them, and whether it can run shell commands. That is what an unauthenticated caller gets, so shrink it before you open the port to anyone else."
      ]
    }
  ],
  "checks": [],
  "ask_rightshold": {
    "start": "https://www.rightshold.com/start?ref=seo",
    "mcp_endpoint": "https://www.rightshold.com/mcp",
    "ask": "Before we start the Dynatrace MCP server in HTTP mode for the on-call team, ask me to approve the exact settings first, with a record I can check later.",
    "mcp_call": {
      "tool": "request_human_approval",
      "arguments": {
        "action": {
          "server": "@dynatrace-oss/dynatrace-mcp-server",
          "server_version": "<the 2.x version you reviewed>",
          "mode": "http",
          "bind": "127.0.0.1",
          "auth": "MCP_BEARER_TOKEN set",
          "exposed_via": "<reverse proxy or gateway that authenticates>",
          "credential_scope": "<the Dynatrace token scopes>"
        },
        "summary": "Start dynatrace-mcp-server in HTTP mode on 127.0.0.1 behind the authenticating proxy",
        "expires_in_minutes": 30
      }
    },
    "also": [
      "Needs a key for your account. It hashes the action details and returns an approval id and a one-time token for the owner. Only the account owner can decide it, with an account key; delegated agent keys are refused, so the agent can't approve its own request. Anyone can check the signed decision free with verify_human_approval, including that the action matches what was approved.",
      "It doesn't start, probe or configure the server, check its version or test its authentication, and it can't stop a request someone sends straight to an open port. Run the unauthenticated probe yourself before approving."
    ],
    "scope": "Rightshold isn't affiliated with Dynatrace, fast-agent, Agent Ops Guide or the Model Context Protocol project, and it doesn't scan networks, run MCP servers or test their authentication. Advisory details are as published in the dynatrace-oss/dynatrace-mcp and evalstate/fast-agent repositories on GitHub, release details from their release pages and docs, the CVE and review dates from the OSV database, the independent test results as reported by Agent Ops Guide, and transport requirements from the MCP specification's Streamable HTTP page, all read November 13, 2026; advisories get updated, so confirm fixed versions on the linked pages."
  },
  "sources": [
    {
      "title": "dynatrace-oss/dynatrace-mcp: GHSA-p7w7-4929-vpj5, unauthenticated HTTP MCP tool invocation (CVE-2026-123811)",
      "url": "https://github.com/dynatrace-oss/dynatrace-mcp/security/advisories/GHSA-p7w7-4929-vpj5"
    },
    {
      "title": "dynatrace-oss/dynatrace-mcp: releases (2.0.0, 2.1.0, 2.1.2)",
      "url": "https://github.com/dynatrace-oss/dynatrace-mcp/releases"
    },
    {
      "title": "evalstate/fast-agent: GHSA-9vhv-g5hf-m7m7, fast-agent serve binds HTTP to 0.0.0.0 with no authentication (CVE-2026-102610)",
      "url": "https://github.com/evalstate/fast-agent/security/advisories/GHSA-9vhv-g5hf-m7m7"
    },
    {
      "title": "OSV: GHSA-9vhv-g5hf-m7m7",
      "url": "https://osv.dev/vulnerability/GHSA-9vhv-g5hf-m7m7"
    },
    {
      "title": "fast-agent docs: Run an MCP Server",
      "url": "https://fast-agent.ai/mcp/mcp-server/"
    },
    {
      "title": "Agent Ops Guide: fast-agent vulnerability CVE-2026-102610, we tested the fix",
      "url": "https://agentopsguide.com/fast-agent-vulnerability-cve-2026-102610/"
    },
    {
      "title": "Model Context Protocol specification: Streamable HTTP (security and endpoint)",
      "url": "https://modelcontextprotocol.io/specification/latest/basic/transports/streamable-http"
    }
  ],
  "related": [
    {
      "title": "Protecting a local MCP server from DNS rebinding",
      "url": "https://www.rightshold.com/answers/how-to-protect-a-local-mcp-server-from-dns-rebinding"
    },
    {
      "title": "How to vet an MCP server before installing it",
      "url": "https://www.rightshold.com/answers/how-to-vet-an-mcp-server-before-installing-it"
    },
    {
      "title": "Inventorying MCP servers with scope, owner, and revocation",
      "url": "https://www.rightshold.com/answers/how-to-inventory-mcp-servers-with-scope-owner-and-revocation"
    },
    {
      "title": "Keep MCP as a thin adapter and recheck authorization on every tool call",
      "url": "https://www.rightshold.com/answers/how-to-keep-mcp-as-a-thin-adapter-and-recheck-authorization-on-every-tool-call"
    },
    {
      "title": "Require human confirmation before MCP write tools run",
      "url": "https://www.rightshold.com/answers/how-to-require-human-confirmation-before-mcp-write-tools-run"
    }
  ],
  "computed_from": "Curated guidance; license verdicts computed from Rightshold's license profiles at render time. Not legal advice.",
  "updated": "2026-11-13"
}