AI agent's API keys are sitting in plaintext (opens in new tab)

(github.com)

1 pointsjulien-poitou2mo ago1 comments

1 comments

53% of MCP servers store API keys as plaintext in config files. They get committed to git, shared across machines, exposed in breaches.

MCPGuard is a local-first CLI that: - Scans your MCP configs for plaintext credentials - Migrates them to your OS keychain (macOS/Linux/Windows) - Replaces values with mcpguard:// references - Injects credentials at runtime — never on disk

One command to audit, one to migrate. No cloud, no account, free and open source.

j / k navigate · click thread line to collapse

1 comments

julien-poitouOP2mo ago

53% of MCP servers store API keys as plaintext in config files. They get committed to git, shared across machines, exposed in breaches.

One command to audit, one to migrate. No cloud, no account, free and open source.

j / k navigate · click thread line to collapse