Open-MCP

The `s3-mcp` server, specifically version 1.0.1 (as per its source code and changelog), explicitly *removed OAuth 2.1 authentication*. It automatically creates 'anonymous' sessions for any incoming request if no valid session ID is provided or if no `Authorization` header is present. This is a critical security risk, making the server unsuitable for untrusted environments or direct internet exposure without an external authentication proxy. S3 access keys (`token`) and secret keys (`userToken`) are passed as plaintext arguments within JSON-RPC requests; without an HTTPS proxy, these credentials are vulnerable to interception. The `s3-mcp` README and Docker instructions are outdated, still mentioning OAuth and `JWT_SECRET` configuration, which creates significant confusion and can mislead users into believing authentication is enforced when it is not in this specific `s3-mcp` version.