MCP servers, which connect AI agents to enterprise tools and data, can expose sensitive credentials through plaintext configuration files, excessive permissions, and prompt injection attacks. These risks often go unnoticed because security teams may not even be aware a server is running. The Model Context Protocol (MCP), an open standard introduced by Anthropic, lets AI assistants access live systems like databases and APIs, but the server acting as a middleman holds the keys—credentials, API tokens, and service account keys—needed to operate.

Common exposure paths include plaintext credentials stored in config files, credential sprawl across ungoverned servers, and prompt injection where hidden instructions in documents or web pages trick agents into leaking secrets. Over-permissioning is another issue, as developers often grant broad scopes that ship to production. Additionally, connecting to an untrusted MCP server can lead to remote code execution, as demonstrated by CVE-2025-6514 in the mcp-remote OAuth proxy, which was downloaded over 400,000 times.

To secure MCP servers, experts recommend centralizing secrets in a managed store, using short-lived credentials with automatic rotation, enforcing least privilege, and keeping a human in the loop for sensitive actions. Encrypting secrets with a zero-trust, zero-knowledge model, logging all agent activity, and maintaining an inventory of MCP servers are also advised. The article notes that tools like Keeper Secrets Manager can mask secrets by default and require confirmation before revealing values, helping organizations protect the MCP layer.

Source: The Hackers News