validoria-mcp

1 of the 74 tools listed anonymously say in their own descriptions that they need an account or a key (guest_get_scan), but the endpoint issued no WWW-Authenticate challenge. The requirement is stated only in prose, so a call reaches the tool and comes back as a tool error instead of an authorization step.

A cross-origin preflight came back without Access-Control-Allow-Origin, so the endpoint is reachable from native clients only — code running in a web page is stopped by the browser before a request is ever sent.

The server exposes a public surface before authorization: guest_start_scan, guest_get_scan, list_targets, get_target, get_target_scores, list_findings, get_finding, list_incidents, get_incident, list_runs, get_run, active_runs, team_stats, target_stats, daily_trends, get_site_map, list_maintenance_windows, list_tests, trigger_test, trigger_all_tests, acknowledge_incident, resolve_incident, mute_finding, create_maintenance_window, delete_maintenance_window, record_deployment, recompute_scores, list_automation_rules, get_automation_rule, create_automation_rule, update_automation_rule, delete_automation_rule, list_journeys, get_journey, create_journey, update_journey, delete_journey, trigger_journey, list_scheduled_reports, create_scheduled_report, update_scheduled_report, delete_scheduled_report, get_team_settings, update_team_settings, list_notification_rules, create_notification_rule, update_notification_rule, delete_notification_rule, list_notification_channels, list_keywords, add_keyword, remove_keyword, start_load_test, cancel_load_test, get_load_test, list_load_tests, list_secrets, store_secret, rotate_secret, delete_secret, list_page_fragments, create_page_fragment, update_page_fragment, delete_page_fragment, create_target, update_target, delete_target, analyze_target, import_targets, create_muting_rule, system_health, update_test, enable_all_tests, disable_all_tests.