Path to credentials or secrets in arguments

Handing a server your SSH, cloud or kubectl credential folder, or an .env file, puts those secrets in reach of the model.

high fs-sensitive-path

Flagged

  6           "-y",
  7           "@modelcontextprotocol/server-filesystem@2025.8.21",
  8 >         "/home/me/.ssh"
  9         ]
 10       }

Fix

Remove the path and share only the project files the server needs.

{
  "mcpServers": {
    "s": {
      "command": "node",
      "args": [
        "s.js",
        "/home/me/projects/app"
      ]
    }
  }
}