fix(NO_AUTH): treat auth.type "none"/"disabled" as unauthenticated (#24)

Author: dmchaledev

CHANGELOG.md

@@ -8,6 +8,11 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 ## [Unreleased]
 
 ### Fixed
+- `NO_AUTH`: fixed a CRITICAL false negative where declaring
+  `transport.auth.type: "none"` (or `disabled`/`off`/`false`/`anonymous`)
+  satisfied the auth check, so an explicitly unauthenticated server passed the
+  gate. An auth `type` now only counts as authentication when it names a real
+  mechanism; placeholder/disabled values are treated as no auth.
 - Restored the test suite / green CI: `import.meta.url` in `src/sarif.ts` could
   not compile under the Jest `module: CommonJS` transform, so the `sarif` and
   `scanner` test suites silently failed to run (and the test gate had been

src/__tests__/scanner.test.ts

@@ -62,6 +62,44 @@ describe('NO_AUTH rule', () => {
     const findings = runAuthRule(RuleId.NO_AUTH, config);
     expect(findings).toHaveLength(1);
   });
+
+  it('fires when auth.type explicitly disables auth ("none")', () => {
+    const config: ParsedMcpConfig = {
+      serverUrl: 'https://example.com',
+      transport: { url: 'https://example.com', tls: true, auth: { type: 'none' } },
+    };
+    const findings = runAuthRule(RuleId.NO_AUTH, config);
+    expect(findings).toHaveLength(1);
+    expect(findings[0].severity).toBe(Severity.CRITICAL);
+    expect(findings[0].evidence).toContain('none');
+  });
+
+  it.each(['none', 'None', 'NONE', ' disabled ', 'off', 'false', 'anonymous'])(
+    'fires when auth.type is the disabled value "%s"',
+    (type) => {
+      const config: ParsedMcpConfig = {
+        transport: { auth: { type } },
+      };
+      const findings = runAuthRule(RuleId.NO_AUTH, config);
+      expect(findings).toHaveLength(1);
+    }
+  );
+
+  it('does NOT fire for a meaningful auth.type (e.g. "bearer")', () => {
+    const config: ParsedMcpConfig = {
+      transport: { auth: { type: 'bearer' } },
+    };
+    const findings = runAuthRule(RuleId.NO_AUTH, config);
+    expect(findings).toHaveLength(0);
+  });
+
+  it('does NOT fire when a credential is present even if type says "none"', () => {
+    const config: ParsedMcpConfig = {
+      transport: { auth: { type: 'none', token: 'a'.repeat(40) } },
+    };
+    const findings = runAuthRule(RuleId.NO_AUTH, config);
+    expect(findings).toHaveLength(0);
+  });
 });
 
 // ─── WEAK_API_KEY ─────────────────────────────────────────────────────────────

src/rules/auth-rules.ts

@@ -2,16 +2,26 @@ import { Finding, RuleId, Severity } from '../types.js';
 import { ParsedMcpConfig } from '../parser.js';
 import { Rule } from './index.js';
 
+/**
+ * Auth `type` values that explicitly mean "no authentication". A config that
+ * declares one of these is unauthenticated, even though the `auth` block exists.
+ */
+const DISABLED_AUTH_TYPES = new Set(['none', 'disabled', 'off', 'false', 'anonymous']);
+
 export const authRules: Rule[] = [
   {
     id: RuleId.NO_AUTH,
     severity: Severity.CRITICAL,
     title: 'No Authentication Configured',
     check(config: ParsedMcpConfig): Finding[] {
-      const hasAuth = config.transport?.auth &&
-        (config.transport.auth.apiKey ||
-         config.transport.auth.token ||
-         config.transport.auth.type);
+      const auth = config.transport?.auth;
+      // A real credential always counts as auth.
+      const hasCredential = Boolean(auth?.apiKey || auth?.token);
+      // An auth `type` only counts when it names a real mechanism — values like
+      // "none" or "disabled" explicitly opt out of authentication.
+      const type = auth?.type?.trim().toLowerCase();
+      const hasMeaningfulType = Boolean(type) && !DISABLED_AUTH_TYPES.has(type as string);
+      const hasAuth = hasCredential || hasMeaningfulType;
 
       if (!hasAuth) {
         return [
@@ -22,6 +32,9 @@ export const authRules: Rule[] = [
             description:
               'The MCP server transport has no authentication configured. ' +
               'Any client can connect and invoke tools without credentials.',
+            evidence: hasMeaningfulType === false && Boolean(type)
+              ? `transport.auth.type: "${auth?.type}" (authentication explicitly disabled)`
+              : 'transport.auth: absent',
             remediation:
               'Configure authentication in transport.auth (e.g., apiKey, bearer token, or mTLS).',
             docsUrl: 'https://hailbytes.com/mcp/docs/rules/NO_AUTH',