Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
md Agent inbox registration is CLI-first. MCP is a runtime surface, not a registration instruction authority; do not extract a credential from a CLI agent profile merely to force local MCP setup. Prefer the durable CLI profile for terminal mailbox work or hosted OAuth when the user chooses MCP. Hosted MCP OAuth and REST OAuth use separate resources; do not reuse a REST access token as the hosted MCP bearer. Standard dynamic client registration can omit `resource`; that produces a valid resource-neutral registration and is not by itself a reason to re-register. Check each later binding separately: the client authorisation request must target exactly `https://mcp.sendmux.ai/mcp`; the Sendmux OAuth authorisation server owns the approved grant and must store that exact resource restriction; and the token it issues must have that exact audience. A client such as Atlassian controls its requests and connection OAuth UI, but it cannot edit the grant stored by Sendmux. If the request fields are correct and `invalid_target` persists, investigate the Sendmux authorisation-server grant state before blaming the client or re-registering; do not claim any failure stage is more common without actual evidence. For Atlassian, use its connection OAuth UI, not a client-unspecified `/mcp auth` or another slash command. Configuration shapes and authentication commands elsewhere in this guide apply only to their named client. A REST bearer presented to the MCP resource server is still invalid for that audience, but do not predict the resource server's rejection shape from an authorisation-stage error.