Grafana MCP server unauthenticated tool call succeeding (HTTP 200)

Arnold Chan@slaz

•updated Sep 6, 2026•0•0•0

Detects instances of an mcp-grafana server responding with an HTTP 200 status code to a 'tools/call' request without an Authorization header, indicating potential unauthenticated remote tool execution on a vulnerable or misconfigured server.