The published npm package "praisonai" exports an "MCPSecurity" helper described in source as: Its "AuthMethod" type advertises five authentication methods: The authentication-policy evaluator, however, only validates credentials for "api-key" and "bearer": For "basic" and "oauth", any non-empty "Authorization" header skips the supplied "validate" callback and returns allowed. A local PoV configures "auth.validate" to always return "false"; invalid "api-key" and "bearer" credentials are rejected, while invalid "basic" and "oauth" credentials are accepted without calling the validator. This is a protection-mechanism failure in the exported npm MCP security helper. It is distinct from the separate issue that the npm "MCPServer" HTTP transport does not enforce authentication by default.