All environment variables handed to an MCP server
HighAV-MCP-111Secrets & data exposureMCP config packNew in 2.0
What it finds
The MCP client starts a server and passes it the entire environment (process.env / os.environ).
Why it matters
Your environment usually holds every API key and token the app uses. Passing all of it gives a third-party server credentials it never needed.
What an attacker could do: The MCP server can read every secret in the parent process's environment.
How to fix it
Pass only the specific variables that server needs.
Pro shows the corrected code for your exact file, step by step, and re-scans to confirm the fix. See plans
Check details
- Finding code
- MCP_SERVER_ENV_PASSTHROUGH
- How it detects
- Looks for a specific risky pattern in the code or config.
- Confidence
- Definite: the risky setting is written plainly in the file.
- Scans
- MCP client configuration files: claude_desktop_config.json, .cursor/mcp.json, .vscode/mcp.json, .mcp.json
- OWASP LLM Top 10
- LLM06 - Sensitive Information Disclosure
- NIST AI RMF
- MS-2.10
- SOC 2
- CC6.1
Check your agent for this
Paste your agent code or MCP config. The free scan runs all 124 checks in about 10 seconds — no account needed.
Related checks
- Hardcoded credentials (generic pattern)AV-SECRET-001 · Critical
- Credential or secret placed in the system promptAV-DATA-002 · High
- Data exfiltration path: private data + untrusted input + outbound channelAV-DATA-003 · High
- Credential stored in plain text in the MCP configAV-MCP-102 · High
- Personal data sent to the model without redactionAV-DATA-004 · High
- Sensitive values written to logsAV-DATA-001 · Medium