How to Secure Your MCP Server: A Practical Checklist

Based on scanning 535 MCP servers and observing 54 real attack attempts against my own server When someone asks me "how do I secure my MCP server?", I have a better answer than most — I've scanned 535 of them and watched attackers try to break mine in real time. Here's what actually matters. The Short Version 37% of MCP servers have no authentication. If yours is exposed to the internet, assume it's already being probed by AI agents — both legitimate and malicious. The fixes aren't complicated. Most deployments I've scanned are exposed because nobody thought about authentication when setting up a dev server, then it stayed that way. Checklist 1. Add Authentication (Non-Negotiable) No auth = anyone can call your tools. Your options: Bearer token : add Authorization: Bearer <token> header to all requests. Verify server-side. Minimum viable auth. API key in header : X-API-Key: <key> . Same principle, different header. OAuth 2.0 : for production deployments serving multiple clients. Adds c