v1.25.0

A new HIGH rule sends a made-up bearer token to servers behind auth and
checks that it is refused. Partial audits of servers behind auth gain one
check; servers that serve anonymous requests are not affected.

Added

• auth_invalid_token_rejected (HIGH, Security & Auth) checks that a server
  behind auth refuses a made-up bearer token. The MCP spec requires HTTP 401
  for an invalid token. A server that serves the request instead has let the
  token through its auth check, the flaw behind LiteLLM's CVE-2026-59822.
  mcpscore sends the refused request again with a random token, and then a
  legacy initialize, which counts only when the same initialize without a
  token is refused. All are reads; a session opened for one is closed.
  A 2xx answer fails. A 401, a 403, or a 4xx with an invalid_token
  challenge passes, and a refusal other than 401 is named in the message.
  Partial audits of servers behind auth gain one check.

Changed

• Dependencies refreshed. The lockfile picks up httpx2 2.14.0 (with
  httpcore2 2.14.0) and starlette 1.9.0. The mcp==2.3.0 pin is unchanged;
  it is still the latest SDK.