I scanned my MCP setup and it scored 0/100. Here's what was wrong.

I've been adding MCP servers to Claude and Cursor for months — GitHub, a filesystem server, a couple of search servers, a little internal HTTP one I wrote. It works great. Then two things bugged me:

Some of those servers have no authentication at all. Anyone who can reach the URL can call my tools.

My context window felt full before I even typed a prompt.

Turns out it's not just me. A 2026 analysis of ~7,000 public MCP servers found 41% require no auth, 36.7% are SSRF-vulnerable, and only 8.5% use OAuth. So I wrote a tiny tool to check my own config — and it scored 0 out of 100.

The tool