Last week I ran a passive OAuth 2.1 audit on 277 public MCP servers. This week the scanner got four new passive checks that read response headers and authorization server metadata without a single extra request. I re-scanned the same host list. 130 were reachable in both sweeps.

One number stuck out.

One check, 121 of 125 reachable servers

HEADERS-001 fires when the initialize response is missing one of four standard transport-security headers:

Strict-Transport-Security on HTTPS

X-Frame-Options or a Content-Security-Policy frame-ancestors directive

X-Content-Type-Options: nosniff

a wildcard Access-Control combination

121 of the 125 servers that were reachable this week trigger at least one. That is 96.8 percent. Only 4 servers had clean transport-security headers.

These are not expensive checks. Each header is one line of configuration on the reverse proxy or in the response code.…