One in every eight credentials found in publicly exposed Model Context Protocol configuration files is a hardcoded secret — a live API key, token, or password baked directly into the file. That’s the finding from new MCP security research published via PR Newswire, and it lands at a moment when AI tooling is being wired into production infrastructure faster than security practices can keep up. The problem isn’t just the exposure — it’s that most scanning tools aren’t built to catch it.
MCP, or Model Context Protocol, has emerged as a standard way to connect AI agents and large language models to external tools, APIs, and data sources. As adoption accelerates, developers are publishing configuration files to public repositories without realizing those files contain credentials that grant real access to real systems. The research found that standard secret-scanning pipelines — the kind most security teams already have in place — are largely blind to how these secrets are structured inside MCP configs, meaning they slip past automated defenses entirely. For enterprises already wrestling with sensitive data exposure, this is yet another attack surface opening faster than it’s being closed.
Why MCP Configs Are a Uniquely Dangerous Leak Vector
Unlike traditional application code, MCP configuration files are often treated as infrastructure scaffolding — developer-facing, quickly iterated, and rarely subject to the same pre-commit scrutiny as source code. They’re also frequently shared across teams or uploaded to public GitHub repositories as setup examples. The research identifies this casual handling as the core risk multiplier: the files look benign to automated scanners because the credential format doesn’t always match the regex patterns those tools are tuned to flag.
The implications run deep. A single exposed API key in an MCP config can give an attacker access to cloud storage buckets, third-party SaaS platforms, or the AI model endpoints themselves — effectively handing over the keys to an entire agentic workflow. The research notes that the problem scales with MCP adoption: the more organizations use the protocol to orchestrate AI agents, the larger the exposed surface becomes. Security teams need pattern libraries and scanning rules purpose-built for MCP file structures, not retrofitted tools designed for conventional codebases.
The Scanning Gap That Makes This Worse
The finding that most scanning tools can’t detect these secrets is arguably more alarming than the exposure rate itself. Organizations operating under the assumption that their existing DevSecOps pipeline catches credential leaks are, in many cases, wrong — at least where MCP configs are concerned. This isn’t a hypothetical edge case. Vulnerability tracking from CISA advisories consistently shows that credential exposure and improper authentication remain among the most exploited vulnerability classes week over week, reinforcing that attackers don’t need sophisticated exploits when plaintext secrets are available for the taking.
The research underscores a pattern that cybersecurity professionals have flagged repeatedly: new developer tooling outpaces the security tooling built to monitor it. MCP is no different. The protocol is less than two years old in widespread use, and the scanning ecosystem hasn’t caught up. Security vendors will need to ship MCP-aware detection rules, and engineering teams will need to treat config files with the same sensitivity as source code — enforcing pre-commit hooks, secret rotation policies, and access scoping for any credentials that must live in these files at all. The 1-in-8 figure is a baseline. Without deliberate action, it’s likely to climb. The industry’s track record on self-imposed safety standards suggests urgency here shouldn’t be taken for granted.
