MCP audit rule · v0.1.0
Secret in headers
A plaintext credential in a header leaks with the config file and grants access to the remote server.
- each server checks
- 2 test fixtures
high secret-in-headers
Flagged
4 "url": "https://example.com/mcp",
5 "headers": {
6 > "Authorization": "••••0000"
7 }
8 }Fix
Reference the secret instead, e.g. "Authorization": "Bearer ${input:token}" (VS Code) or an env reference, and rotate the exposed key.
Fine
{
"mcpServers": {
"s": {
"url": "https://example.com/mcp",
"headers": {
"Authorization": "Bearer ${input:token}"
}
}
}
}