high
Secret passed as a command-line argument
A credential appears in the args array, so it's part of the command line that launches the server.
Why it matters
Command lines are visible to other processes on the machine (ps, Task Manager) and often end up in logs and crash reports.
How to fix it
Pass the credential through an environment variable that isn't written into the config file, and rotate the exposed one.
Before
{
"mcpServers": {
"api": {
"command": "node",
"args": [
"server.js",
"--api-key",
"sk-proj-EXAMPLEEXAMPLEEXAMPLE1234"
]
}
}
}After
{
"mcpServers": {
"api": {
"command": "node",
"args": [
"server.js"
],
"env": {
"API_KEY": "${API_KEY}"
}
}
}
}Illustrative configs. The checker flags the “before” version with this finding and not the “after” version.
Other checks
- Secret written into an MCP config
- Secret inside an MCP server URL
- Remote MCP server over unencrypted http
- Remote MCP server with no credentials configured
- Unpinned MCP server package or image
- MCP server installs without asking (npx -y)
- MCP server container runs --privileged
- MCP server container shares the host network
- Broad host folder or Docker socket mounted into an MCP container
- MCP filesystem server with access to a very broad path
- MCP server launched through a shell
- MCP server that can run shell commands
- MCP tools auto-approved or always allowed