[BUG] fastapi-mcp HTTP transport allows unauthenticated access to MCP tools when AuthConfig is not configured

Author: pzr21Created Aug 4, 2026Updated Aug 4, 2026

Labelsbug

Describe the bug fastapi_mcp 's HTTP transport does not require authentication when no AuthConfig is configured. A server created with the default FastApiMCP(app).mount_http() setup exposes MCP tools to anonymous clients, allowing unauthenticated access to wrapped FastAPI routes.

To Reproduce Run the following script:

python

from fastapi import FastAPI
from fastapi_mcp import FastApiMCP
import uvicorn

app = FastAPI()

@app.get("/items")
async def list_items():
    return [{"id": 1, "name": "demo"}]

mcp = FastApiMCP(app)
mcp.mount_http()    
uvicorn.run(app, host="0.0.0.0", port=8001)

Then interact with the MCP endpoint without any Authorization header.

Initialize an MCP session:

bash

curl -i http://127.0.0.1:8001/mcp \
  -H 'Content-Type: application/json' \
  -H 'Accept: application/json, text/event-stream' \
  -d '{"jsonrpc":"2.0","id":1,"method":"initialize","params":{"protocolVersion":"2024-11-05","capabilities":{},"clientInfo":{"name":"curl-test","version":"1.0"}}}'

List available tools anonymously:

bash

curl -i http://127.0.0.1:8001/mcp \
  -H 'Content-Type: application/json' \
  -H 'Accept: application/json, text/event-stream' \
  -H 'mcp-session-id: <SESSION_ID>' \
  -d '{"jsonrpc":"2.0","method":"notifications/initialized"}'

Call the exposed FastAPI route anonymously:

bash

curl -i http://127.0.0.1:8001/mcp \
  -H 'Content-Type: application/json' \
  -H 'Accept: application/json, text/event-stream' \
  -H 'mcp-session-id: <SESSION_ID>' \
  -d '{"jsonrpc":"2.0","id":2,"method":"tools/list","params":{}}'

Expected If no AuthConfig is present, the server should either refuse to expose the HTTP endpoint or reject anonymous MCP requests with an authentication error.

Actual The anonymous request with no Authorization header was accepted, and the server returned a successful MCP response instead of an auth failure:

HTTP 200 OK
{"jsonrpc":"2.0","id":2,"result":{...}}

System Info fastapi_mcp version: 0.4.0 Python: 3.10.12 OS: Ubuntu 22.04 LTS, Linux 6.5.13-5-pve, x86-64

Source: tadata-org/fastapi_mcp

View original on GitHub View discussion on GitHub