Google's MCP Servers Are Open — And That's Intentional (But Here's the Risk)

Google's MCP Servers Are "Open" — And That's Intentional (But Here's the Risk) When we scan MCP servers in the wild, we flag servers without authentication as security risks. Simple rule: if anyone can call your tools without credentials, that's a problem. So imagine our surprise when Google's own MCP servers — BigQuery, Compute Engine, Container Engine — showed up as auth_required: false in our dataset of 540 production MCP servers. Is Google doing MCP security wrong? No. But they're making an architectural choice that the security community needs to understand. What We Found From active scanning of 540 production MCP endpoints: Server Auth (Protocol Level) Tools Dangerous Operations bigquery.googleapis.com/mcp No 5 execute_sql compute.googleapis.com/mcp No 29 create_instance, delete_instance, stop_instance container.googleapis.com/mcp No 8 list_clusters, get_cluster mapstools.googleapis.com/mcp Yes 3 search_places You can call tools/list on compute.googleapis.com/mcp right now, witho