AP005: Secret inline in MCP server config
| Severity | critical |
| Runs in | scan, git push check |
| One-line fix | Rotate the key, then make the MCP server read it from an environment variable instead of the config file. |
What it finds
Section titled “What it finds”A key written straight into an MCP server entry: in its env, its headers, its arguments, its
command or its URL. Files such as .mcp.json and .cursor/mcp.json are often committed, and
README snippets say “paste your token here”.
The print names the server and the field, and shows the key masked, for example sk_l…(len 36).
Why it matters
Section titled “Why it matters”MCP configs are among the most copied agent files. A key in one is as exposed as a key in any settings file, so this is a critical print.
How to fix
Section titled “How to fix”- Rotate the key. Revoke it and create a new one.
- Make the MCP server read the key from an environment variable instead of the config file. The fix in each print says how, for that agent.
Limits
Section titled “Limits”- Pattern-based only. An odd key format can be missed.
- AP005 replaces AP002 for the same key in the same file. Keys elsewhere in that file stay AP002.
- agentprint never starts or contacts an MCP server.