AGENTFORCE-MCP-15: MCP Named Credential Without Authentication
🔴 High · MCP Authentication
Detects Salesforce Named Credentials whose callouts carry no authentication (legacy NoAuthentication / Anonymous, or an External Credential with authenticationProtocol NoAuthentication) when they point at an MCP server or are used by agent-reachable Apex that speaks MCP JSON-RPC.
Details
| Field | Value |
|---|---|
| Rule ID | AGENTFORCE-MCP-15 |
| Severity | High |
| Category | MCP Authentication |
| Compliance | OWASP_MCP_TOP_10, SOC2_CC7 |
Remediation
Give the MCP server real authentication (OAuth 2.0 client credentials or JWT bearer, or a custom header principal stored in the External Credential) and set the External Credential's authenticationProtocol accordingly; require that token on the MCP server.