Can MCP Servers Expose Secrets?

Overview

As enterprises increasingly adopt AI agents into their workflows, Model Context Protocol (MCP) servers have emerged as a powerful bridge between AI and enterprise systems. But with that convenience comes risk: MCP servers often hold the keys to critical infrastructure—credentials, API tokens, and service account secrets. If left unsecured, they can silently expose enterprise secrets long before security teams realize the server is running.

What is Model Context Protocol (MCP)?

• MCP is an open standard introduced by Anthropic.
• It allows AI agents to connect to external tools and data, pulling records, opening files, or calling APIs.
• The MCP server acts as the middleman, exposing specific actions the AI agent can perform.
• To function, MCP servers require credentials—making them a hub for sensitive secrets.

How MCP Servers Expose Secrets

• Plaintext credentials: Tokens and keys stored in local config files, often in plaintext, risk accidental leaks through repositories or disk copies.
• Credential sprawl: Secrets duplicated across dev, staging, and production environments remain static and unrotated, creating multiple entry points.
• Prompt injection: Attackers embed hidden instructions in documents or tickets, tricking agents into misusing tools or exposing secrets.
• Over‑permissioning: Broad permissions granted during development often persist into production, exposing far more than necessary.
• Exposed servers: Malicious MCP servers can exploit vulnerabilities, such as CVE‑2025‑6514, leading to OS command injection and credential theft.

Security Implications

Because MCP servers transform AI agents into non‑human identities (NHIs) with operational access, a leaked secret doesn’t just expose data—it grants attackers the ability to act on enterprise systems. This elevates MCP from a convenience layer to a critical security frontier.

Best Practices for Securing MCP Servers

• Centralize secrets: Remove hardcoded credentials from config files and store them in a governed secrets manager.
• Use short‑lived credentials: Automate rotation to minimize exploitation windows.
• Enforce least privilege: Limit agent access to only what’s necessary.
• Human‑in‑the‑loop: Require explicit confirmation for sensitive actions like retrieving unmasked secrets.
• Zero‑knowledge encryption: Ensure secrets are end‑to‑end encrypted and unreadable even if the vault is compromised.
• Audit agent activity: Maintain logs of all agent actions for compliance and incident response.
• Inventory MCP servers: Eliminate shadow AI by tracking every MCP server in use.

Expert in the Cloud Insight

MCP servers have quietly introduced a new layer of enterprise risk. They sit between AI agents and critical systems, holding the credentials that unlock them. Organizations must rethink secrets management for AI, applying the same rigor as they would for any production system. Centralization, least privilege, and encryption are no longer optional—they are essential to securing the MCP layer.