◆MCP Config Guard

MCP SECRET SCANNER

Find credentials before your MCP config leaks them.

MCP client configurations often contain the exact values an attacker wants: API keys, database URLs, OAuth tokens, and filesystem paths. Scan the file locally, then replace long-lived credentials with safer runtime injection.

Fast answer: a credential inside env is still plaintext. The variable name does not protect the value when both are stored in the same JSON or TOML file.

What the scanner detects

The checker looks at every string value, not only an env object. It recognizes common provider token prefixes, private-key blocks, credential-bearing database URLs, and keys named like token, password, or api_key. Evidence is redacted before it appears in the report.

Risky MCP configuration

{
  "mcpServers": {
    "github": {
      "command": "npx",
      "args": ["@example/github-mcp"],
      "env": { "GITHUB_TOKEN": "ghp_live_value_here" }
    }
  }
}

Anyone who can read the file, a backup, a support bundle, a dotfiles repository, or a copied chat message may gain the same access as the token.

How to remediate a detected secret

  1. Revoke or rotate the exposed credential.
  2. Remove it from the config and version-control history.
  3. Use the client's supported environment or secret mechanism.
  4. Reduce its scopes and expiry time.
  5. Confirm the MCP server cannot print the credential into logs or tool output.

False positives and limits

Pattern matching can flag placeholders and test strings. Conversely, a proprietary credential may have no recognizable prefix. Treat every finding as a review prompt, not as proof that a token is active. Static scanning also cannot inspect credentials fetched after startup.

Scan without uploading your config

The browser-only checker handles common Claude, Cursor, VS Code, Gemini, Windsurf, Cline, and Codex structures.

Open the MCP secret scanner →