Detect plaintext credentials in MCP config files#44
Open
dfirdeferred wants to merge 1 commit into
Open
Conversation
MCP server configurations commonly carry API tokens in their env and
headers blocks. Best practice is to use environment variable references
(${VAR_NAME}) so secrets are never written to disk. This change inspects
env values and authentication headers during MCP config scanning and
emits plaintext_credential findings when a value appears to be a
hardcoded secret.
Findings are emitted in the same NDJSON record stream as package and
exposure records so receivers can act on them without new parsing logic.
Each finding includes the credential redacted to its identifying prefix
(e.g. sk-ant-api***, ghp_***, AKIA***) and a remediation message
telling the user to replace the value with an env-var reference.
Detection covers 21 well-known API-key prefixes (Anthropic, OpenAI,
GitHub, AWS, Google, Slack, Stripe, GitLab, etc.) and applies a
conservative heuristic for unknown formats: secret-suggesting key name
paired with a long, high-entropy value. Env-var references, known
non-secret keys, file paths, and URLs are excluded to minimize false
positives.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
plaintext_credentialfindings for hardcoded API keys and tokens in MCP configenvandheadersblockssk-ant-api***,ghp_***,AKIA***) — the actual secret never appears in the output${VAR_NAME}and set the secret in the shell environment or a secrets managerformats
findingrecord format as existingpackage_exposurefindings — no new record types or output formatsMotivation
MCP config files are a growing attack surface as developers configure AI tool integrations. It's common for users to paste API keys directly into env blocks instead of using
${VAR}references, leaving plaintext credentials on disk. Since bumblebee already scans these files for package inventory, it's a natural place to surface this class of misconfiguration.
Changes
internal/model/model.go: newFindingTypePlaintextCredentialconstantinternal/scanner/scanner.go: wiresEmitFindingcallback to the MCP scannerinternal/ecosystem/mcp/mcp.go: credential detection, redaction, and remediation logic; parsesheadersfieldinternal/ecosystem/mcp/mcp_test.go: 7 new test functionsTest plan
${VAR}) never produce findings