MCP OAuth Diagnostics
A 401 on MCP initialize usually is not a failure: an endpoint that rejects anonymous requests is declaring that it needs auth, and an anonymous check should respect that. In our October 2026 scan of the official registry, 5,069 of 9,991 remote endpoints (50.7%) gave no anonymous handshake, and the registry does not label which of them are OAuth-gated by design. mcpreflight therefore reports them as UNKNOWN with a note, never as broken. This page covers what mcpreflight can and cannot diagnose today. Numbers: State of MCP Servers.
mcpreflight does not currently implement a complete OAuth auditor. Read the honest scope and limits.