Exposing Hardcoded MCP Credentials in Public GitHub Repositories

Post Views: 5

Research conducted by Hush Security has revealed the presence of hardcoded API keys, access tokens, and other authentication credentials within publicly accessible configuration files on GitHub.

Research Findings

Hardcoded Credentials in MCP Systems

Research conducted by Hush Security has revealed the presence of hardcoded API keys, access tokens, and other authentication credentials within publicly accessible configuration files on GitHub. These files are associated with Machine-Code Proxy (MCP) systems, according to the firm’s report titled *The State of MCP Configuration: The Identity Security Gaps*. The analysis examined approximately 82,000 configuration files, identifying that 12% of credential slots contained hardcoded literals, potentially exposing access to connected services and infrastructure.

Methodology and Classification

The study focused on configuration filenames used by major coding agents, analyzing environment values and authentication headers to classify credential storage methods. Researchers categorized credential slots into six types: hardcoded values, environment-variable references, client-managed prompts, secret-manager references, placeholders, and empty fields. To detect hardcoded secrets, the team employed provider-specific patterns and Shannon entropy, a metric measuring randomness.

Git History Risks

Deleted Secrets Can Persist

Removing sensitive information from the latest version of a file does not guarantee its elimination from a repository. Git retains previous versions, allowing deleted values to remain accessible via commit history. Researchers analyzed the history of 7,681 credential-bearing configurations, reviewing up to seven revisions prior to the current version. They identified 243 configurations where a secret had been removed from the latest file but remained in an earlier commit.

CEO Insights

Quotes from Micha Rave

Micha Rave, CEO of Hush Security, emphasized that traditional security practices—such as secret scanning, commit blocking, and rotation—are insufficient in this context. “These files are meant to be committed; the secret never should be. When it is, the highest-risk credentials in them match no known pattern, and the identities behind them have no owner and no expiry. That’s a whole population of access tokens sitting out in public Git with no one watching,” Rave stated.

MCP and Machine Identity Challenges

Impact of Long-Lived Credentials

The study found that 24% of hardcoded credential literals were of types that are both broad-scope and non-expiring by design. Additionally, 53% of credentials with a defined scope provided organization-, account-, workspace-, or database-wide access. For credentials with an expiration policy, 80% did not expire by default. Long-lived credentials with extensive permissions amplify the risk of exposure, as a single compromised credential could grant access to multiple resources or sensitive functions.

Machine Identity Complexity

MCP connections enable AI agents to interact with source code, databases, cloud infrastructure, and other services on behalf of users or organizations. These agents operate as non-human identities, using credentials to authenticate with systems without requiring human intervention for each interaction. As the adoption of such agents grows, organizations must track which agents have access, the permissions they hold, their responsible parties, and the expiration of their access. The findings underscore the growing complexity of managing machine identities in environments where AI-driven systems rely on persistent credentials.

Conclusion

The lack of standardized expiration policies and ownership accountability for these credentials further complicates security efforts, leaving organizations vulnerable to potential misuse.