MCP servers for agents running unattended
An unattended agent — a cron job, a CI step, a scheduled sweep — should hold MCP servers that are API-key or no-auth authenticated, read-heavy, and capped server-side, because every assumption an interactive session makes breaks the moment nobody is watching: no one completes an OAuth redirect, approves a risky call, or notices a retry loop until the bill arrives. This guide is the checklist for picking that fleet — which auth models survive headless, where autonomy must stop, and the caps that replace the missing human.
What changes when nobody is watching
An attended agent has a free safety mechanism: you. You complete the auth flow, you skim the plan before approving the risky call, you kill the loop that is on its fourth identical retry. Unattended, all three controls must move somewhere structural — auth into a secret store, approval into an action queue, and the loop-killer into hard caps the agent cannot negotiate with. Teams that lift their interactive MCP config into cron unchanged discover this in order: first the OAuth server fails on a missing redirect, then a token expires two weeks in, then a metered API bills for a night of retries.
The good news is that the ecosystem leans the right way: 53% of the servers we rank authenticate with an API key and 17% need no auth at all — both models work identically with or without a human. The 30% on OAuth 2.1 are where unattended planning actually takes work.
Auth models, ranked for headless survival
Check this column before features. A server whose auth cannot run headless is not on your unattended shortlist, whatever it does.
| Auth model | Unattended fit | Notes |
|---|---|---|
| No auth (local) | Ideal | Filesystem, Git, Time — spawned by the runner, nothing to expire. |
| API key | Ideal | Lives in the secret store; every run identical. Scope and cap the key. |
| Service account / machine credential | Good | Headless by design (e.g. BigQuery). Prefer over user OAuth when offered. |
| User OAuth 2.1 (delegated) | Fragile | Needs one interactive grant + refresh-token custody; expiry is a silent outage. |
| OAuth with browser-per-session | Unusable | Anything demanding a redirect at run time simply fails headless. |
A refresh token is a pet, not cattle
The autonomy ladder
Sort every tool the agent holds onto one of four rungs. The rung — not the model's judgement — decides whether the action runs, runs with caps, queues for approval, or is simply not mounted.
| Rung | Examples | Why the line sits here |
|---|---|---|
| Full autonomy | Search, fetch, schema introspection, read-only queries, reading mail/tickets/logs | Nothing to undo. The worst outcome is a wasted run. |
| Autonomy with caps | Scraping on a metered key, LLM sub-calls, writes to a scratch branch or internal store | Reversible or internal, but costs money or space — cap per run, not per call. |
| Draft, then queue | External email, PR creation on shared repos, ticket replies, calendar invites | Reversible technically, expensive socially. A human approves during working hours. |
| Never unattended | Production DNS, payments, deletes without soft-delete, public posting | Irreversible and outward-facing. No prompt is a sufficient control. |
The fourth rung is not a prompt-engineering problem. "Never unattended" means the server is not in the unattended config at all — an agent cannot misuse a tool it does not hold. That is the same least-privilege reasoning developed in the least-privilege guide, applied at the config level instead of the scope level.
A concrete starter fleet
The shape that works for overnight triage, scheduled research, and CI review agents — every entry either read-only, internal, or capped:
Workspace: Filesystem + Git
No auth, local stdio, spawned by the runner. The agent reads and edits inside a checkout; the write boundary is a branch, which is exactly as reversible as unattended writes should be.
DetailsRepo surface: GitHub on a fine-grained PAT
Scope the token to the specific repos and the minimum permissions (contents + pull-requests beats repo-wide admin). The agent opens PRs and comments; humans merge.
DetailsResearch: Tavily or Firecrawl on a capped key
Both are API-key servers with usage-based billing — which is precisely why the key needs a budget cap at the vendor. A retry loop against a scraper is the classic unattended bill.
DetailsData: a database MCP against a read-only role
GRANT SELECT plus a server-side statement_timeout. The database-level grant is the control; any MCP-side read-only flag is advisory. Details in the databases buyer’s guide.
DetailsTell-a-human: Postmark or Resend on a subdomain
The one send an unattended agent should own is the internal alert. A strictly transactional sender on a dedicated subdomain keeps a misfire cheap and your main domain’s reputation untouched.
DetailsCaps are the human's replacement — set all three
Frequently asked questions
What counts as an unattended agent?
Any agent run with no human present to click, approve, or notice: a cron job that triages issues overnight, a CI step that reviews a diff, a scheduled research sweep, a monitoring agent that files tickets. The defining constraint is that every interactive assumption breaks — nobody completes an OAuth redirect, re-enters an expired token, approves a risky tool call, or catches a runaway loop until it has already run.
Which auth model works best for unattended MCP servers?
API keys and no-auth local servers. An API key in the runner's secret store authenticates every run identically with nothing interactive in the path — which is why the 53% of ranked servers using API keys are the natural unattended fleet. Interactive OAuth (30% of ranked servers) assumes a browser redirect on first run; unattended, that means pre-provisioning tokens interactively and owning their refresh lifecycle, and a revoked or expired refresh token becomes a silent outage.
Can I use OAuth-based MCP servers in CI at all?
Yes, with eyes open: complete the OAuth flow once interactively, store the refresh token in the CI secret store, and treat token refresh failure as a first-class alert rather than a log line. Servers whose platform offers machine credentials (service accounts, client-credentials grants) are the better unattended path than user-delegated OAuth, because nothing about them expires with a human account. If the vendor offers only user-interactive OAuth, consider whether the workflow platform (n8n, Zapier) should hold that integration instead of your runner.
Which tools should an unattended agent never hold?
Tools whose mistakes are irreversible and outward-facing: sending email to external humans, editing production DNS, moving money, deleting data, posting publicly. The unattended pattern for these is draft-and-queue — the agent prepares the action and a human approves it during working hours. Reserve full autonomy for read-only tools and for writes that are internal, rate-limited, and reversible (a git branch, a draft, an internal alert).
How do I stop an unattended agent from burning money in a retry loop?
Assume the loop will happen and cap it in three places the agent cannot talk its way past: per-run budget limits on metered APIs (scraping, proxies, LLM calls), rate limits and statement timeouts enforced server-side, and a wall-clock timeout on the run itself. An attended agent retrying a failing call costs seconds; an unattended one costs until the cap — so the cap, not the prompt, is the control.
Do stdio MCP servers work in headless environments?
Yes — stdio is a local process the runner spawns, no browser involved, which suits CI runners well. The catch is provisioning: 86% of ranked servers ship stdio, and each one needs its runtime (npx, uvx, Docker) present in the environment plus its credentials in env vars. Remote streamable-http servers invert the trade: nothing to install, but the credential must be a headless-friendly token and the runner needs network egress to the vendor.
What should an unattended agent starter kit look like?
Read-heavy and API-key-authenticated. A typical fleet: Filesystem and Git (no auth, local) for the workspace; GitHub with a fine-grained PAT scoped to the target repos; a search or scraping server like Tavily or Firecrawl on a budget-capped API key; a database server pointed at a read-only role; and a strictly transactional email sender like Postmark or Resend on a dedicated subdomain for the "tell a human" step. Every write path in that kit is either internal, draft-only, or capped.
Building the attended version first?
The security fundamentals — prompt injection, credential rotation, sandboxing — apply to both modes and are covered in their own guides.
More guides
Setup Guide
Best MCP Servers for Email in 2026 (Ranked + Setup)
9 min read
Setup Guide
Best MCP Servers for Scheduling & Calendar in 2026
9 min read
Research
State of MCP, Q3 2026: What 393 Servers Tell Us
7 min read
Research
MCP Category Coverage in 2026: Where the Servers Actually Are
6 min read
Comparison
AWS MCP vs Azure MCP: Which to Use in 2026
7 min read
Comparison
Square MCP vs Stripe MCP: Which to Use in 2026
7 min read
Ranked Guide
Best MCPs for DevOps in 2026 (Ranked)
11 min read
Vertical Guide
Best MCPs for Domains and DNS in 2026 (Ranked)
8 min read
Comparison
Namecheap vs GoDaddy vs Cloudflare MCP (2026)
7 min read
Vertical Guide
Best MCPs for Payments in 2026 (Ranked)
8 min read
Vertical Guide
Best MCPs for Invoicing and Accounting in 2026
9 min read
Comparison
Stripe MCP vs PayPal MCP: Which to Use in 2026
6 min read
Ranked Guide
Best MCP Servers for Postgres in 2026 (Ranked)
12 min read
Ranked Guide
Best MCP Servers for Browser Automation in 2026 (Ranked)
12 min read
Ranked Guide
Best MCP Servers for Vector Databases in 2026 (RAG-Ready)
11 min read
Ranked Guide
Best MCP Servers for Git in 2026 (GitHub, GitLab, Bitbucket, Local)
11 min read
Ranked Guide
Best MCP Servers for Workflow Automation in 2026 (Ranked)
11 min read
Ranked Guide
Best Free MCP Servers in 2026 (No API Key Required)
10 min read
Comparison
GitHub vs GitLab MCP: Which to Use in 2026
8 min read
Comparison
Pinecone vs Qdrant vs Chroma MCP: Which to Use (2026)
9 min read
Comparison
Playwright vs Browserbase MCP: Local vs Cloud (2026)
8 min read
Comparison
Postgres MCP vs Supabase MCP: Which to Use (2026)
8 min read
Comparison
n8n vs Zapier vs Make MCP: Which to Use (2026)
9 min read
Ranked Guide
Best MCP Servers for Deploying Websites in 2026 (Ranked)
11 min read
Comparison
Vercel vs Netlify vs Cloudflare MCP: Which to Use (2026)
9 min read
Tutorial
Deploy to Vercel With an AI Agent (Vercel MCP, 2026)
7 min read
Tutorial
Deploy to Cloudflare With an AI Agent (Cloudflare MCP, 2026)
7 min read
Strategy
Can an AI Agent Deploy to Production? (Safely, in 2026)
8 min read
Fundamentals
What Is MCP? A Plain-English Guide to Model Context Protocol
6 min read
Setup Guide
Best MCPs for Cursor in 2026 (Ranked + Setup)
8 min read
Setup Guide
Best MCPs for Claude Desktop in 2026 (Ranked + Setup)
9 min read
Setup Guide
Best MCPs for Claude Code in 2026 (Ranked + Setup)
8 min read
Setup Guide
Best MCPs for Codex CLI in 2026 (Ranked + config.toml)
8 min read
Setup Guide
Best MCPs for Windsurf in 2026 (Cascade-Ready Setup)
8 min read
Setup Guide
Best MCPs for VS Code in 2026 (Agent Mode + .vscode/mcp.json)
8 min read
Vertical Guide
Best MCPs for Marketing in 2026 (Ranked + Use Cases)
9 min read
Vertical Guide
Best MCPs for SEO in 2026 (Ranked + Workflows)
9 min read
Vertical Guide
Best MCPs for Data Teams in 2026 (Ranked + Workflows)
9 min read
Vertical Guide
Best MCPs for Security in 2026 (Ranked + Posture Workflows)
10 min read
Strategy
MCP Registry vs Curated Directory: Which Should You Use?
5 min read
Setup Guide
Best MCPs for ChatGPT: The Apps and Connectors Worth Installing
9 min read
Tutorial
How to Add an MCP Server to ChatGPT (Developer Mode + Apps Directory)
8 min read
Security
MCP Security: What to Know Before You Install
9 min read
Role Guide
Best MCPs for Marketers in 2026 (SEO, Email, Analytics)
8 min read
Strategy
Remote vs Local MCP Servers: When to Use Each
7 min read
Fundamentals
MCP vs Function Calling: What’s the Difference?
6 min read
Comparison
MCP Directories Compared: Top MCPs vs mcp.so vs PulseMCP vs mcp.directory
8 min read
Security
MCP Prompt Injection: How Tool-Calling Agents Get Hijacked
8 min read
Security
OAuth 2.1 for MCP: What the Spec Standardised and What You Need to Know
8 min read
Security
Sandboxing MCP Servers: Containers, Least Privilege, and Process Isolation
9 min read
Security
Rotating MCP Credentials: A Practical Guide for Leaks, Expiry, and Routine Hygiene
7 min read
Security
Least-Privilege Scoping for MCPs: How to Grant the Smallest Useful Permission
7 min read
Setup Guide
Best MCP Servers for Databases in 2026 (Ranked + Setup)
10 min read
Setup Guide
Best MCP Servers for Research in 2026 (Search, Scrape, Synthesize)
9 min read
Setup Guide
Best MCP Servers for Design-to-Code in 2026 (Figma → React)
9 min read
Setup Guide
Best MCP Servers for Domains in 2026 (Registrars + DNS)
9 min read
Tutorial
How to Buy a Domain From Claude (Cloudflare MCP, Step by Step)
6 min read
Tutorial
How to Search for Domains With an AI Agent (Cross-Registrar Workflow)
7 min read
Tutorial
How to Deploy a Website With an AI Agent (MCP Workflow)
8 min read