Repository navigation
[Agents] Clarify risk of unauthenticated MCP examples - #34810
Open
kantorcodes wants to merge 3 commits into
Open
kantorcodes wants to merge 3 commits into
kantorcodes wants to merge 3 commits into
Conversation
kantorcodes
requested review from
a team,
irvinebroque and
rita3ko
as code owners
October 31, 2026 02:04
github-actions
Bot
added
the
product:agents
Contributor
AI Review✅ Reviewed Resolved (1) · Dismissed (0)
Commands
|
Contributor
Review coverage🟡 1 ownership area needs approval. Suggested reviewers: @irvinebroque @southpolesteve
CODEOWNERS mappings for displayed areas (1)
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Add a caution next to the unauthenticated remote MCP example. Anyone who can reach a deployed unauthenticated
/mcpendpoint can call its tools, so the example should remain limited to harmless public data. The note links to the existing OAuth and authorization guide and explains why CORS and Origin checks do not replace access controls.Verification
production.:::cautionblocks and that the linked security guide exists.pnpmdocumentation build was not run; there are no code changes.