MCP-004 Inline credential in env block

An MCP host config puts a live credential (GITHUB_TOKEN: ghp_...) in a server's env block instead of a ${VAR} reference. The secret then lives in a JSON file nobody audits, in backups, and in any folder synced to a cloud service.

What Vulkro detects

An env entry where:

1. the key contains a credential name (AWS_ACCESS_KEY_ID, GITHUB_TOKEN, STRIPE_API_KEY, SLACK_BOT_TOKEN and others, shared with the secrets detector),
2. the value is not empty, and
3. the value is not a ${VAR} / $VAR reference.

Severity	When
Critical	name match and the value matches a provider format (AWS, Stripe, GitHub, Slack, PEM private key, JWT and others)
High	name match and value length 16 or more
Medium	name match only, short or opaque value

Confidence is High with a provider-format match, Medium otherwise. Evidence signals: mcp-env-secret-name-match (weight 0.5, Pattern), plus mcp-env-secret-provider-format-match (weight 0.7, Pattern) on a format match.

The finding never contains the secret value: only the key name and a coarse length bucket (<8, 8-15, 16-23, 24-31, 32-39, 40-47, 48-63, 64-127, 128+), since an exact length could fingerprint it.

Non-compliant code

{
  "mcpServers": {
    "github": {
      "command": "uvx",
      "args": ["mcp-server-github==0.4.2"],
      "env": { "GITHUB_TOKEN": "ghp_3rL9aXk2qNvT8WzC0xY1fE6sBpH4dM7uV5jK" }
    }
  }
}

Compliant code

The host resolves GITHUB_TOKEN from the OS environment at launch.

{
  "mcpServers": {
    "github": {
      "command": "uvx",
      "args": ["mcp-server-github==0.4.2"],
      "env": { "GITHUB_TOKEN": "${GITHUB_TOKEN}" }
    }
  }
}

How to fix

• Replace the literal with a ${VAR} reference.
• Set the variable in a shell rc file, a per-project direnv file, or the OS keychain or a secrets manager.
• Rotate the credential: copies remain in backups and in git history if the file was tracked.

References

• CWE-798: Use of Hard-coded Credentials
• CWE-256: Plaintext Storage of a Password
• CWE-312: Cleartext Storage of Sensitive Information
• OWASP A05:2021 Security Misconfiguration

See also: vulkro mcp-audit, Secrets detection, Confidence model.