Hush Security Finds Hardcoded Secrets in 12% of Public MCP Credential Slots

Hush Security found hardcoded secrets in 12% of credential slots across roughly 82,000 public Model Context Protocol configuration files, the company said in a press release. The files were used by coding agents including Claude Code, Cursor, VS Code, Windsurf, Gemini, OpenAI Codex and JetBrains.

The exposed credentials included GitHub personal access tokens, Anthropic and OpenAI API keys, Slack and Notion workspace tokens, and database connection strings with embedded passwords. Hush said 55% of the secrets lacked recognizable token patterns used by tools such as gitleaks and GitHub secret scanning.

Among credentials with a defined scope, 53% provided access across an organization, account, workspace or database. Of those with a defined expiry policy, 80% did not expire by default. Hush also found 1,394 secrets in current files and 243 deleted secrets that remained accessible through Git history.