auth_required
auth_required is the outcome we record when an MCP endpoint answers a connection attempt with HTTP 401 or 403. It means the address answered, was serving, and was guarding itself at the moment we asked. It is the most common result we have recorded, and it describes a working server rather than a broken one.
What does auth_required mean?
It means the server answered. A 401 or 403 is a considered response from software that is running, listening, and deciding that this particular caller may not proceed.
Compare that to an address that times out, refuses the connection, or does not resolve. Those describe an endpoint that is not there. A 401 describes one that is.
Why is it not a failure?
Because the thing being tested succeeded. The connection was established, the request was delivered, and the server exercised its own authorization logic correctly.
Treating it as a failure produces exactly the wrong ranking. It marks the production servers with real data behind them as broken while marking wide-open ones as healthy, which inverts the signal a reader wants.
How often does it happen?
More often than a successful connection. Across 82 attempts against 53 endpoints between 20 July and 5 August 2026, we recorded 40 auth_required results and 29 connections.
The remaining 13 were genuine problems: 4 protocol errors, 3 addresses that served a web page rather than an endpoint, 2 blocked by our own outbound guard, 2 unreachable, and 2 that did not resolve. Those are the outcomes that describe something wrong.
Example
Several of the best-known hosted MCP servers answer an anonymous initialize with a 401, which is what OAuth 2.1 requires of an internet-facing server. Supplying a valid scoped token turns the identical request into a normal handshake and a normal tool list. The endpoint never changed; only the caller's credentials did.