AG-NOAUTH: Agent HTTP Server: No Authentication Configured

What this rule means

The agent exposes its tools over HTTP with no authentication middleware detected. Any process that can reach the server — an internal network attacker, or an SSRF vulnerability elsewhere — can invoke agent capabilities directly.

Why it matters

The same class of exposure NSA's May 2026 guidance flagged across 200,000+ MCP instances, generalized to any agent HTTP server, not just MCP specifically.

How to fix it

Add authentication middleware (Bearer token, API key, or OAuth) before deploying an agent HTTP server.

Detect it

pip install lucin
lucin scan .                  # all rules
lucin explain AG-NOAUTH          # this rule, in your terminal

Findings carry a file:line and, where the rule supports it, a witness path showing the flow that triggered it. Precision and recall for the whole rule set, with the commands that regenerate them, are on the benchmarks page — and the gaps are on limits.

← All detection rules