Credential stored in plain text in the MCP config
What it finds
An MCP server's env block contains what looks like a real token, key, or password written directly in the config file.
Why it matters
MCP config files get copied, synced to the cloud, pasted into chats, and committed to repos. A token in plain text there is easy to leak.
What an attacker could do: Anyone who sees this file gets the full access of that token (for example your GitHub or Slack account).
How to fix it
Rotate the token now. Then reference it from your environment (for example "${GITHUB_TOKEN}") or your OS keychain instead of pasting it into the config, and give it the narrowest scopes possible.
Pro shows the corrected code for your exact file, step by step, and re-scans to confirm the fix. See plans
Check details
- Finding code
- MCP_SECRET_IN_CONFIG
- How it detects
- Looks for a specific risky pattern in the code or config.
- Confidence
- Likely: strong signal, but review it in context.
- Scans
- MCP client configuration files: claude_desktop_config.json, .cursor/mcp.json, .vscode/mcp.json, .mcp.json
- OWASP LLM Top 10
- LLM06 - Sensitive Information Disclosure
- NIST AI RMF
- MS-2.10
- SOC 2
- CC6.1
Check your agent for this
Paste your agent code or MCP config. The free scan runs all 124 checks in about 10 seconds — no account needed.
Related checks
- Hardcoded credentials (generic pattern)AV-SECRET-001 · Critical
- Credential or secret placed in the system promptAV-DATA-002 · High
- Data exfiltration path: private data + untrusted input + outbound channelAV-DATA-003 · High
- All environment variables handed to an MCP serverAV-MCP-111 · High
- Personal data sent to the model without redactionAV-DATA-004 · High
- Sensitive values written to logsAV-DATA-001 · Medium