high
Secret inside an MCP server URL
A remote server URL carries a key or token in its query string or user-info.
Why it matters
URLs are logged by proxies, load balancers and servers, and are easy to paste into chat or tickets.
How to fix it
Send the credential in a header that references a variable, or use the server's OAuth sign-in. Rotate the exposed value.
Before
{
"mcpServers": {
"reports": {
"url": "https://mcp.example.com/sse?api_key=realkey123456"
}
}
}After
{
"mcpServers": {
"reports": {
"url": "https://mcp.example.com/sse",
"headers": {
"Authorization": "Bearer ${REPORTS_TOKEN}"
}
}
}
}Illustrative configs. The checker flags the “before” version with this finding and not the “after” version.
Other checks
- Secret written into an MCP config
- Secret passed as a command-line argument
- Remote MCP server over unencrypted http
- Remote MCP server with no credentials configured
- Unpinned MCP server package or image
- MCP server installs without asking (npx -y)
- MCP server container runs --privileged
- MCP server container shares the host network
- Broad host folder or Docker socket mounted into an MCP container
- MCP filesystem server with access to a very broad path
- MCP server launched through a shell
- MCP server that can run shell commands
- MCP tools auto-approved or always allowed