Obot versions up to 0.22.1 with registry authentication enabled do not properly enforce authentication on the MCP Registry API endpoints under /v0.1/*. This allows unauthenticated users to read registry server metadata such as names, descriptions, repository URLs, icons, and connect URLs. No secret credentials or environment variables are exposed, and connecting to servers remains protected by authentication. The issue is fixed in version 0.23.0 and later.