MCP security for coding agents: secrets in config files, server vetting and allowlists

Executive summary

• Three practical MCP problems: secrets in config files, unvetted servers, and what a server can reach—with per-tool config paths.
• GitGuardian found 5.2% of sampled public MCP repos leaked at least one secret, and later 24,008 unique secrets in public MCP configs (2,117 valid).
• Compare MCP gateway vs agent hooks vs enterprise LLM gateway: ReclaimLLM’s gateway is an LLM gateway (model calls), not an MCP gateway.
• Egress guard does not inspect MCP server process traffic; AD-015 only specially flags a tool named exactly mcp_fetch.

MCP (Model Context Protocol) servers run with the developer’s permissions and often hold API tokens in plain config files. Secure them by moving tokens out of config, approving servers on an allowlist, inspecting MCP tool calls at the agent hook, and limiting where servers can send data. This post is a practical checklist for Claude Code, Cursor, Copilot, Codex, and Antigravity—not a generic “top ten MCP risks” list.

For how ReclaimLLM’s own MCP tools work, start with MCP tools and skills. For shell egress, see stopping AI agent network exfiltration.

What an MCP server can do on a developer laptop

An MCP server is a small program the agent invokes over stdio or HTTP. Local servers inherit the user’s filesystem and environment. Remote servers receive OAuth tokens and may proxy data to third-party APIs.

The MCP security best practices draft calls out risks you should name in security reviews:

• Confused deputy and token passthrough
• SSRF via tool parameters
• Session hijacking on remote transports
• Compromise of a local MCP server binary
• Over-broad tool scopes

OWASP LLM02 Sensitive Information Disclosure applies when MCP tools return secrets or internal code to the model.

Developers adopt MCP because it is fast—not because InfoSec reviewed the publisher. Your governance page should treat new MCP server names like new npm dependencies: owner, data classification, and review date. The weekly review in small-team AI governance explicitly reserves five minutes for “MCP servers seen in sessions that are not on the allowlist.”

Problem 1: secrets in MCP configs

Public registries are not secret-safe. GitGuardian analyzed repositories from the Smithery.ai MCP registry and reported: “202 of them leaked at least one secret. That’s 5.2% of all the repositories.” (A look into the secrets of MCP, April 2025.)

In public MCP configuration files more broadly, GitGuardian’s 2026 secrets sprawl report found “24,008 unique secrets in public MCP configuration files, 2,117 of them valid.” (AI coding agents and credential security, September 2026.)

Where configs live (verify before audit)

| Tool | Typical MCP config location | | --- | --- | | Claude Code | ~/.claude.json and project .mcp.json | | Cursor | .cursor/mcp.json or ~/.cursor/mcp.json | | VS Code / Copilot | .vscode/mcp.json | | Antigravity | ~/.gemini/config/mcp_config.json; OAuth tokens in ~/.gemini/antigravity/mcp_oauth_tokens.json | | Codex | ~/.codex/config.toml under [mcp_servers] |

Fixes:

• Reference environment variables or a secret manager—never commit tokens.
• Add MCP config paths to secret scanning in CI and on dotfile repos.
• Rotate any token that ever lived in a committed JSON file.

Example safe pattern in JSON (fake placeholder only):

{
  "mcpServers": {
    "example": {
      "env": {
        "API_TOKEN": "${env:EXAMPLE_API_TOKEN}"
      }
    }
  }
}

Never paste a live token into documentation, tickets, or this blog’s issue tracker.

Problem 2: unvetted servers

Treat every MCP server like installing a mini SaaS integration:

1. Allowlist approved server names and publishers.
2. Pin versions or package hashes where the tool supports it.
3. Prefer read-only scopes until you understand data flow.
4. Use vendor admin controls: Claude managed settings, Cursor team policies, Copilot enterprise MCP management where available.

Distribution channels matter. ReclaimLLM’s agent plugin marketplaces (June 2026) are one path—your allowlist process should cover marketplaces, not just npm installs.

GitHub documents that content exclusion does not guarantee the same boundaries for third-party MCP servers—plan accordingly.

Problem 3: what the server can reach

Hooks see agent-initiated MCP tool calls

| Client | How ReclaimLLM observes MCP | | --- | --- | | Cursor | Dedicated beforeMCPExecution / afterMCPExecution events (hooks docs recommend failClosed: true for security-critical MCP hooks—ReclaimLLM’s installer does not set failClosed by default) | | Codex | Tool names with prefix mcp__<server>__<tool>; Codex CLI parses hook output but does not apply updatedMCPToolOutput today—a CLI limitation | | Claude Code | MCP calls use the same PreToolUse / PostToolUse path as other tools, identified by tool name only |

Copilot and VS Code agent hooks with MCP capture (Oct 2026) extend the same normalized tool-call model ReclaimLLM uses for sessions (normalized session tool calls).

When the hook runs, recognized .env DLP is fail-closed for that class. Hook crash or timeout can still fail open—complement hooks with coverage detection, not assumptions.

Network egress is not the same as MCP inspection

The pre-execution egress guard covers agent shell commands and similar paths on Claude Code, Cursor, Antigravity, Codex, and Copilot. It does not inspect traffic emitted by an MCP server process on its own socket—that traffic never passes through the shell guard.

Post-session, AD-015 external network egress anomaly detection flags suspicious outbound patterns in captured sessions for Claude Code, Cursor, Codex CLI, GitHub Copilot, Gemini CLI, Windsurf, and OpenCode. It is not general MCP traffic inspection: among native tool names, AD-015 treats an exact match on mcp_fetch like other web-fetch tools. It does not cover Antigravity in the AD-015 client list—do not conflate egress guard (which does cover Antigravity) with AD-015 coverage.

If an MCP server wraps HTTP fetches, the agent may expose code to that server without a shell curl. That is why MCP allowlists and hook capture matter alongside egress guard—layered controls, not one checkbox.

MCP gateway vs hooks vs enterprise LLM gateway

| Control | Sees | Misses | | --- | --- | --- | | MCP gateway / proxy | Remote MCP HTTP traffic you route through it | Local stdio servers, direct configs on disk | | Agent hooks | MCP tool calls the agent makes (inputs; output rewriting varies by client) | Hook failure modes, uninstall, tools bypassing the agent | | Enterprise LLM gateway | Model API requests you proxy | MCP entirely, local file reads |

ReclaimLLM’s enterprise LLM gateway is an LLM gateway—provider keys and model policy—not an MCP gateway. Say that plainly in architecture diagrams.

Our own MCP server, held to the same rules

ReclaimLLM ships an MCP server (May 2026) with a growing set of read and replay tools—search sessions, file brief, replay compression experiments, and related helpers. See MCP tools and skills for the current list rather than duplicating it here.

The local API key resolved from env or hook config grants read access to session data—the same class of secret as any other MCP token. Store it in a secret manager, rotate on offboarding, and never commit it to .mcp.json.

Antigravity documents MCP setup separately (Antigravity MCP); OAuth token files sit beside JSON config. Include both in quarterly dotfile scans—the token file is as sensitive as the config entry it pairs with.

When MCP tools pull source code into third-party APIs, you are in source-code leakage territory, not just secrets. Read source code leakage through AI assistants for the five-path map; this post owns MCP configuration and tool-call visibility.

MCP security checklist (copyable)

• [ ] Inventory MCP configs per tool path in the table above.
• [ ] Remove inline secrets; use env var indirection.
• [ ] Publish an allowlist of server names and owners.
• [ ] Install hooks and verify MCP rows appear in session detail.
• [ ] Route P0 secret alerts to an owner (AD-004).
• [ ] Review third-party MCP in content-exclusion gaps (Copilot docs).
• [ ] Quarterly: re-scan dotfiles and rotate OAuth token files (Antigravity path).

Data residency for captured sessions: US or EU only. Encrypted storage for Paid/Enterprise is not zero-knowledge. SOC 2 Type II targeted early 2027—not certified today.

Next step

See every MCP tool call your agents make—start free. Product overview: AI coding assistant DLP. Operator guide: MCP tools and skills.

FAQ

What is an MCP security gateway?

A proxy that terminates MCP HTTP traffic so you can authenticate, log, and policy-check remote servers. It does not replace hooks for local stdio servers unless you re-architect how developers launch MCP.

Where are MCP server credentials stored in Cursor / Claude Code / Antigravity?

Typically JSON or TOML under the paths in the table above—often plaintext unless you substitute environment variables. Antigravity also stores OAuth tokens in ~/.gemini/antigravity/mcp_oauth_tokens.json.

Are MCP servers safe to install?

They are only as safe as the publisher and the scopes you grant. Assume compromise until vetted; use allowlists and least privilege.

Can hooks block MCP tool calls?

Yes, when the hook runs and the client honors deny decisions—Cursor documents fail-closed MCP hooks if you set failClosed: true. ReclaimLLM does not set that flag automatically. Crash and timeout behavior remains a separate risk.

Does an LLM gateway secure MCP traffic?

No. The enterprise LLM gateway secures model API calls routed through ReclaimLLM—not MCP stdio servers or arbitrary MCP HTTP unless you add a separate MCP proxy.