Mcp Client

• Outcome: Review
• Latest audit: Sep 10, 2026 · 10:15 PM UTC
• Version: 1.0.3

Overview

This is a disclosed MCP client, but it needs Review because it can use broad remote MCP capabilities and may expose API keys if used with unsafe URLs or command-line secrets.

Install only if you intend to connect to MCP servers you control or strongly trust. Prefer HTTPS endpoints, avoid passing API keys directly on the command line, use narrowly scoped or short-lived keys, and inspect available tools and resources before invoking them.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

• Location: mcp_client.py:16

Finding

API Credentials May Be Exposed Through Plaintext HTTP and Command-Line Arguments

Content

View full analysis

Vulnerability Details

File Location: mcp_client.py:16-31, mcp_client.py:108-109, and SKILL.md:27
Vulnerability Type: Insecure transport and sensitive credential exposure
Risk Level: Medium

Vulnerable Code

python

DEFAULT_MCP_SERVER = "http://localhost:8080"


class MCPClient:
    """Client for Model Context Protocol"""
    
    def __init__(self, server_url=DEFAULT_MCP_SERVER, api_key=None):
        self.server_url = server_url.rstrip("/")
        self.session = requests.Session()
        if api_key:
            self.session.headers["Authorization"] = f"Bearer {api_key}"
    
    def connect(self):
        """Connect to MCP server"""
        resp = self.session.get(f"{self.server_url}/mcp/connect")
        resp.raise_for_status()
        return resp.json()

python

parent_parser.add_argument("--server-url", default=DEFAULT_MCP_SERVER, help="MCP Server URL")
parent_parser.add_argument("--api-key", help="API Key")

The documented invocation also places the API key in a command-line argument:

powershell

.\mcp.ps1 -Action connect -ServerUrl "https://mcp-server.com" -ApiKey "your-key"

Technical Analysis

The client accepts arbitrary server URLs without validating their scheme or requiring TLS. When an API key is supplied, it is installed as a Bearer token in the session's Authorization header and sent to the configured endpoint. Although the default HTTP endpoint is loopback-only, a user can provide a non-loopback http:// URL, causing the credential and subsequent MCP traffic to be transmitted without transport encryption.

The CLI additionally accepts the API key directly through --api-key, while the documentation recommends a corresponding command-line credential argument. Command-line secrets may be exposed through shell history, process inspection facilities, diagnostic tooling, terminal recordings, or command logging.

Attack Path

...[truncated 1180 chars]

Remediation

View remediation

Remediation Suggestions

1. Require https:// for all non-loopback MCP endpoints. Reject plaintext HTTP rather than merely documenting the risk.
2. If local HTTP support is necessary, permit it only for explicitly recognized loopback addresses such as localhost, 127.0.0.1, and ::1.
3. Validate the parsed URL before constructing the client session, including its scheme and hostname.
4. Remove or deprecate direct API-key command-line arguments.
5. Read credentials from a protected environment variable, operating-system credential store, restricted configuration file, or interactive hidden prompt.
6. Avoid including credentials in logs and exception messages, and redact authorization data from diagnostic output.
7. Document secure credential provisioning and warn users not to place secrets in shell history.
8. Apply narrowly scoped, short-lived API credentials and support credential rotation to limit the consequences of disclosure.

SkillSpector

Vulnerability Patterns

• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (1)

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 92% confidence

Finding

The skill exposes network/MCP connectivity but does not declare any explicit tool scope or permissions boundaries. Because this skill is specifically designed to connect to remote MCP servers that can expose tools and resources, the lack of declared restrictions increases the chance of unintended access to external services or sensitive data sources, especially if an agent can invoke it broadly.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.