Secret in URL

URLs end up in logs, history and shared configs, so a credential in one is easily exposed.

high secret-in-url

Flagged

  3       "s": {
  4 >       "url": "https://••••••@example.com/mcp"
  5       }

Fix

Remove credentials from the URL and send them in a header referenced from an input or env variable, then rotate the exposed key.

{
  "mcpServers": {
    "s": {
      "url": "https://example.com/mcp"
    }
  }
}