Study: 25% of Public MCP Configs Leak API Keys in Plaintext
checkpointdev · reddit · 2026-08-22
A security audit of MCP (Model Context Protocol) configs reveals significant credential leakage risks in public repositories.
- Data: Scanned 2,000 configs across 1,622 GitHub repos; 1,113 defined environment variables.
- Findings:
- 25% (279) contained plaintext secrets.
- 17% (196) correctly used variable indirection.
- 26 exposed valid credential formats for vendors like GitHub, Anthropic, and OpenAI.
- Observation: Many leaks were AWS doc examples; excluding them reduced false positives by 10%.
- Tool: Released mcp-secrets CLI (npx mcp-secrets scan) to detect plaintext keys and migrate them to the OS keychain, supporting CI checks.
More from coding & agent
- YC F26's Praxis launches AI agents to run law firm ops end to end — ycombinator · 2026-10-16
- Developer builds inter-agent messaging for his AI agents — complete with message undo — baditaflorin · 2026-10-16
- iOS 'dots' workflow: one Siri command turns screenshots into a background shopping and saving agent — nickbaumann_ · 2026-10-16
- Your widget tree is already a list of options: where Jev fits in Flutter — rseroter · 2026-10-16
- How OpenAI's Codex went from failed side project to 40M weekly users in under a year — danshipper · 2026-10-16
- Photon 2.0 launches unified messaging API for AI agents across iMessage and more — Scobleizer · 2026-10-16