Finding the MCP Servers Your Platform Team Doesn't Know About
Originally published at webofmike.com on 2026-09-16. The demo repo and every command in it were run before publishing. An MCP server is a small HTTP service. Anyone on your team can start one in an afternoon, and the useful ones get built precisely because they reach something valuable: the warehouse, the ticket tracker, the build agent, the CRM. None of that appears in a service catalog, and the…
MCP servers are small HTTP services that can be easily set up by anyone on a team. Unlike services found in a catalog, there is no port to identify an MCP server. To detect them, a scanner was created that sends a JSON-RPC initialize request over HTTP POST to various hosts and ports. The scanner costs just one request, works without credentials, and identifies the server by its response.
The scanner was applied to five endpoints and found four MCP servers, one of which used an outdated transport method that would have been missed by a current-transport-only scan. A single initialize request is enough to reveal what tools the server offers. For example, a server at http://mcp-open:8080/mcp responded with a list of tools including run_query, send_email, and list_customers.
The server descriptions provided by the tools are written for a model, often disclosing internal hostnames, ports, and service account names. Servers that do not implement the MCP authorization spec will return a 401 HTTP response. For servers that do implement the spec, a 401 with a WWW-Authenticate header containing the resource metadata document can be used to obtain information on supported scopes and how to present a token.
Written by urgent.news from Dev.to's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.
