Secret in command arguments

Arguments are visible in process listings and logs, and the config file is often shared.

critical secret-in-args

Flagged

  5         "args": [
  6           "--token",
  7 >         "ghp_••••0000"
  8         ]
  9       }

Fix

Read the secret from an environment variable the server supports, referenced as "${env:NAME}", and rotate the exposed key.

{
  "mcpServers": {
    "s": {
      "command": "npx",
      "args": [
        "--token",
        "${env:GITHUB_TOKEN}"
      ]
    }
  }
}