Which MCP servers and API operations need credentials?

Operations whose document establishes no authentication requirement and whose endpoint refuses an anonymous request anyway, observed on 2026-09-10. A server that answers 401 is alive - this is not a list of broken things, it is a list of things an agent cannot plan around from the document alone.

452 records across 31 subjects, observed 2026-09-10. Every one carries a check you can run in a single request.

Snyk API49
Nookipedia32
Braze Endpoints30
RAWG Video Games Database API30
EtMDB REST API v127
Postman API26
smart-me22
bunq API21
DocuSign REST API19
ExaVault18
SIGNL4 API18
agentOS Api V2, Customer Login Call Group18
API Reference - Ideal Postcodes17
PayRun.IO17
Hetzner Cloud API16
Developer documentation14
Listen API: Podcast Search, Directory, and Insights API13
eNanoMapper database11
Vonage Integration Suite10
Remote Settings PROD8
Clever-Cloud API7
Medium API7
Notion API7
Just Eat UK3
OpenUV - Global Real-Time UV Index Forecast API3
Clubhouse API2
IP Geolocation API2
ipinfodb.com2
IP2Proxy Proxy Detection1
Klarna Payments API V11
Wolfram1

All subjects ยท the whole registry, machine-readable

This is not a list of good APIs or bad ones. It is a list of observations, each dated and each disprovable in one request. Absence from it means an operation was not examined, not that it is fine.