Hardcoded MCP credentials found in public GitHub files

Hush Security's report "The State of MCP Configuration: The Identity Security Gaps" found that 12% of credential slots in roughly 82,000 publicly accessible MCP configuration files on GitHub contained a hardcoded credential literal, potentially exposing credentials for connected services and systems. The research identified hardcoded API keys and access tokens used by AI coding tools in those public files.

Hardcoded API keys, access tokens and other credentials used by AI coding tools have been found in publicly accessible MCP configuration files on GitHub, according to research from Hush Security’s The State of MCP Configuration: The Identity Security Gaps report. The company analyzed around 82,000 configuration files and found that 12% of credential slots contained a hardcoded credential literal, potentially exposing credentials for connected services and systems. How the exposed credentials were identified Researchers searched … More https://www.helpnetsecurity.com/2026/09/18/hush-security-mcp-credential-exposure-report/ The post Hardcoded MCP credentials found in public GitHub files https://www.helpnetsecurity.com/2026/09/18/hush-security-mcp-credential-exposure-report/ appeared first on Help Net Security https://www.helpnetsecurity.com .