MCP Security Kit by Agent Trust Cloud

high

Secret passed as a command-line argument

A credential appears in the args array, so it's part of the command line that launches the server.

Why it matters

Command lines are visible to other processes on the machine (ps, Task Manager) and often end up in logs and crash reports.

How to fix it

Pass the credential through an environment variable that isn't written into the config file, and rotate the exposed one.

Before

{
  "mcpServers": {
    "api": {
      "command": "node",
      "args": [
        "server.js",
        "--api-key",
        "sk-proj-EXAMPLEEXAMPLEEXAMPLE1234"
      ]
    }
  }
}

After

{
  "mcpServers": {
    "api": {
      "command": "node",
      "args": [
        "server.js"
      ],
      "env": {
        "API_KEY": "${API_KEY}"
      }
    }
  }
}

Illustrative configs. The checker flags the “before” version with this finding and not the “after” version.

Check your own config

Other checks