diff --git a/auth-exemptions.json b/auth-exemptions.json
index efe9d4f3..d1244ec7 100644
--- a/auth-exemptions.json
+++ b/auth-exemptions.json
@@ -151,6 +151,9 @@
     "vtex-docs": {
       "reason": "Predates the withAuth requirement — 2 findings pending remediation."
     },
+    "wake": {
+      "reason": "Open for parity with the other deco-hosted commerce MCPs (VTEX, Shopify, Magento). Re-add withAuth once Mesh token-forwarding lets end users connect without supplying the shared secret."
+    },
     "whatsapp": {
       "reason": "Predates the withAuth requirement — 1 finding pending remediation."
     },
diff --git a/wake/server/main.ts b/wake/server/main.ts
index ca7a09bb..85187a92 100644
--- a/wake/server/main.ts
+++ b/wake/server/main.ts
@@ -6,7 +6,6 @@
  */
 import { withRuntime } from "@decocms/runtime";
 import { serve } from "@decocms/mcps-shared/serve";
-import { withAuth } from "@decocms/mcps-shared/auth";
 
 import { tools } from "./tools/index.ts";
 import { type Env, StateSchema } from "./types/env.ts";
@@ -25,11 +24,11 @@ const runtime = withRuntime<Env, typeof StateSchema>({
 });
 
 /**
- * `withAuth` is mandatory: this MCP is served on a public hostname, so every
- * request must present the shared secret from the AUTH_TOKEN environment
- * variable. It is read at startup — without it the process exits instead of
- * serving anonymous traffic. `scripts/check-auth.ts` fails CI if it is removed.
+ * Served without `withAuth` for parity with the other deco-hosted commerce MCPs
+ * (VTEX, Shopify, Magento…), which are still open pending the shared-secret
+ * rollout. Tracked in `auth-exemptions.json`; re-add `withAuth` once the Mesh
+ * token-forwarding path is in place so end users don't have to supply a secret.
  */
 if (runtime.fetch) {
-  serve(withAuth(runtime.fetch));
+  serve(runtime.fetch);
 }