This MCP transport is mounted on an Express route with NO auth middleware.

Why this matters

The tools are reachable unauthenticated (CWE-306). The route passes only (path, handler): there is no requireBearerAuth(...) in the chain, so any caller can drive the MCP server. A Knostic scan found none of ~2,000 internet-exposed MCP servers required auth.

Put requireBearerAuth(...) before the transport handler: const auth = requireBearerAuth({ verifier, resourceMetadataUrl }); app.post('/mcp', auth, async (req, res) => { await transport.handleRequest(req, res, req.body); });

// ruleid: auth.mcp.unauthenticated-server
app.post('/mcp', async (req, res) => {
  await transport.handleRequest(req, res, req.body);
});

const auth = requireBearerAuth({ verifier, resourceMetadataUrl });
// ok: auth.mcp.unauthenticated-server
app.post('/mcp', auth, async (req, res) => {
  await transport.handleRequest(req, res, req.body);
});

Suppressing this rule

If a finding is a genuine false positive, scope the suppression to the exact line and leave a reason, never disable the rule project-wide. Disable directives are line-scoped by design.

// oauthlint-disable-next-line auth.mcp.unauthenticated-server -- <reason>

References