Severity: HighResearchNHI/credential
Plaintext API keys in committed .mcp.json files found across public repos
Global
Sample data. Showing illustrative sample items as a fallback — the live feed is not available right now.
A scan of public repositories surfaced thousands of long-lived API keys and database credentials stored directly in .mcp.json and .env files committed alongside agent configs. Several keys were still valid and mapped to over-scoped non-human identities.
What to do
Move credentials into a vault with runtime injection, rotate any key that ever touched a config file, and scope each non-human identity to the minimum it needs.
Mapped framework pillars
Sources
#NHI#secrets sprawl#credential leak