MCP Servers: A New Secret-Leak Vector

Enterprises rushing to deploy AI agents may be handing over the keys to their most sensitive systems without realizing it. The Model Context Protocol (MCP), an open standard that lets AI assistants connect to external tools and data, has introduced a new layer where credentials, API tokens, and service account keys can be exposed—often before security teams even know the server is running.

The MCP Connection

MCP, originally introduced by Anthropic, allows AI agents to reach live systems, pulling records from databases, opening files, or calling APIs. The MCP server acts as a middleman, exposing specific actions the agent can perform. But to act on a system, the server requires that system's credentials, making it a hub for secrets. As agents become active identities operating across enterprise systems, a leaked secret doesn't just expose data; it grants an attacker the ability to act on it.

Plaintext Credentials in Config Files

MCP servers routinely store tokens and keys in local configuration files, often in plaintext. In many setups, getting a server running means pasting in a configuration string that contains the credentials themselves. If that file is left on a disk, it's likely to be overlooked, copied between machines, or committed to a Git repository by accident. Once an attacker reaches that server, everything it holds is readable.

Credential Sprawl Across Ungoverned Servers

Without a central location to store secrets, every AI agent ends up managing its own. The same credentials get scattered across config files and environment variables, with duplicate copies piling up across development, staging, and production. Because no one has a full inventory of these secrets, they rarely get rotated, leaving them valid and static indefinitely. Each scattered, long-lived secret can be stolen by an attacker, creating another potential entry point for a breach.

Prompt Injection and Over-Permissioning

Not every leak requires an attacker to break in. Because AI agents read and act on the material they are given, an attacker may hide instructions within a document, support ticket, or web page the agent accesses. The agent may follow those hidden directions, treating them as legitimate commands in what is referred to as prompt injection. Agents can be tricked into misusing their tools or handing over the secrets they were trusted to protect.

To avoid authorization errors while building, developers often grant MCP servers broad permissions and move on. Those generous scopes tend to ship to production if they are forgotten about. When least privilege isn't enforced, an AI agent can reach far beyond what's necessary for its task, meaning any single compromise exposes much more than it should have.

The Exposed-Server Risk

Anyone can publish an MCP server, which is a supply chain issue waiting to happen. Connecting to an untrusted one can turn against you, as CVE-2025-6514 demonstrated. In mcp-remote, an OAuth proxy downloaded over 400,000 times that runs on the client machine, a malicious server could trigger OS command injection, leading to remote code execution on the machine running the proxy and granting attackers access to steal its credentials.

Securing the MCP Layer

MCP changes where secrets live and who reaches them, but the measures for protecting them must be applied intentionally to this new AI layer. Best practices include pulling credentials out of config files and centralizing them in a single managed store, using short-lived credentials that expire on their own, enforcing least privilege, keeping a human in the loop for sensitive actions, encrypting secrets with a zero-trust, zero-knowledge model, logging and auditing everything the agent does, and inventorying MCP servers to eliminate shadow AI.

Organizations must apply the same rigor they would apply to any other production system holding secrets, which means centralizing credentials and controlling what each agent can reach are essential. Tools built for this, like Keeper Secrets Manager, mask secrets by default and require confirmation before any value is revealed, so AI agents can use credentials without leaving them exposed.

The MCP layer is a new frontier for enterprise security, and the stakes are high. As the source warns, every organization should question what secrets they are handing to AI and how well those secrets are protected once they reach an MCP server. This is not a problem that will solve itself; it requires deliberate action to ensure that the convenience of AI agents does not come at the cost of security.