Trends · Updated 2026-10-17
MCP servers behind OAuth
In short: More than half (737 of 1,364) of the MCP servers we scored ask for auth before they list their tools, including 241 of the 302 endpoints hosted on Smithery. That keeps them secure, but agents and registries cannot see what they do before connecting.
Signal: 737 of 1,364 scored MCP servers required auth (2026-10-17)
Why is this trend rising?
- Enterprise tools (CRMs, docs, code hosts) need user-scoped access
- The MCP auth spec uses OAuth 2.1 with protected-resource metadata
How can you act on this trend?
- Publish /.well-known/oauth-protected-resource
- Allow unauthenticated initialize and tools/list where you safely can
- Describe each tool so agents know when to use it
Which tools support this trend, and how do they compare?
| Score | Tool | Type | Host |
|---|---|---|---|
| 81 | ClarityTrack Ask your AI about your own accounts, debts, budgets and goals. OAuth sign-in, read-only by default. | MCP · auth | www.claritytrack.ai |
| 81 | Edgaze Find and run AI workflows from the Edgaze marketplace in your agent. Sign in with OAuth. | MCP · auth | mcp.edgaze.ai |
| 76 | whatsapp WhatsApp assistants, messaging, broadcasts, and analytics for your iZap account, over OAuth. | MCP · auth | api.izap.ai |
| 76 | JustOnce Persistent memory for AI assistants — one shared, OAuth-secured vault for every MCP client. | MCP · auth | mcp.justonce.ai |
| 70 | Ankra Deploy and operate Kubernetes: clusters, stacks, apps, logs, metrics and security, with OAuth. | MCP · auth | platform.ankra.app |
| 70 | ByteRay AI Hunt zero-days by talking to binaries. 40+ tools. Hosted, OAuth + SSO, invite: hi@byteray.ai | MCP · auth | mcp.byteray.ai |
| 70 | Caybl Hosted MCP server for GA4, Google Ads and Search Console. Google OAuth, nothing to install. | MCP · auth | api.caybl.ai |
| 70 | Клод Кот — генерация изображений и видео Best Image and video generation: 20+ models (Kling, Seedance, Veo, NB, FLUX.2), OAuth, pay-per-use. | MCP · auth | mcp.klodkot.ai |
| 70 | amazon-ads Ask your Amazon Ads account anything and act with guardrails. Remote MCP, OAuth, free to connect. | MCP · auth | api.sellermate.ai |
| 59 | colaunched Your Colaunched account: ideas scored for you, their evidence and your launch. OAuth sign-in. | MCP · auth | mcp.colaunched.ai |
| 57 | Docspeed Extract, ask, compare and parse PDFs/images with source evidence. OAuth sign-in or API keys. | MCP · auth | api.docspeed.ai |
| 49 | paseo List AugmentEV's agents and run text generation on a hosted open model (Standard). API key required. | MCP · auth | api.augmentev.ai |
| 46 | entity-verification Verified business-identity intelligence for AI agents & MCP clients — company verification, VAT, BORME, GLEIF, | MCP · auth | server.smithery.ai |
| 46 | United States Weather Provide real-time and forecast weather information for locations in the United States using natural language q | MCP · auth | server.smithery.ai |
| 46 | AI Research Assistant The server provides immediate access to millions of academic papers through Semantic Scholar and arXiv, enabli | MCP · auth | server.smithery.ai |
What else do people ask?
Why does my MCP server return 401?
It requires OAuth. Clients find the authorization server through the WWW-Authenticate header and /.well-known/oauth-protected-resource.
Want tomorrow's movers by email?
One short email a day: new agent tools, the biggest trust-score moves, and one build you can copy. Free.