A
92/100 First Seen
Feb 18, 2026
Last Scanned
Feb 20, 2026
Findings
1
Score
92/100
MEDIUM 1
Findings (1)
MEDIUM
Shell metacharacters in MCP config args
L92 Detects shell metacharacters (pipes, backticks, subshells) in MCP server command arguments
"command":"git push origin main"}}' | FIX
Remove credentials (API keys, tokens, passwords) from MCP server configuration. Use environment variable references (e.g., ${API_KEY}) or a secrets manager instead of inline values.
FP?
Likely FP if the credential value is a placeholder (e.g., your-api-key-here, sk_test_xxx) in example configuration.