# MCP auth mechanism

Check id `mcp-auth-mechanism` · Connectability · runs in the deep scan · pre-release, in calibration

**What we look for.** Whether your MCP server's sign-in matches what it does: public for docs, OAuth for product data.

**Why it matters.** A product server without sign-in exposes data; a docs server behind sign-in shuts out agents for no reason.

**How to pass.** Require OAuth on servers that act on account data, and leave read-only docs servers open.

This check needs a deep scan, which the hosted monitor will run.