T09 · Insecure Skill Coding Practices
Warning
- Location
- references/exa-mcp-setup.md:14
- Finding
- API Key Exposed Through MCP Endpoint Query String<![CDATA[ ## Vulnerability Details **File Location**: `references/exa-mcp-setup.md`, lines 14 and 21–27 **Vulnerability Type**: API credential exposure through URL query parameters **Risk Level**: Medium ### Vulnerable Code At line 14: ```markdown `https://mcp.exa.ai/mcp?exaApiKey=${EXA_API_KEY}&tools=web_search_exa,web_search_advanced_exa,people_search_exa` ``` The same pattern is included in the configuration example at lines 21–27: ```json { "mcpServers": { "exa": { "transport": { "type": "streamable-http", "url": "https://mcp.exa.ai/mcp?exaApiKey=${EXA_API_KEY}&tools=web_search_exa,web_search_advanced_exa,people_search_exa" } } } } ``` ### Technical Analysis The documented configuration places `${EXA_API_KEY}` directly in the MCP endpoint's query string. Although the example uses an environment-variable placeholder rather than a hardcoded credential, the placeholder will normally be expanded into a real API key when the configuration is used. URL query strings can be captured by MCP client diagnostics, HTTP infrastructure, proxy logs, telemetry systems, exception reports, configuration exports, screenshots, or process-level debugging. HTTPS protects the URL while it is transmitted over the network, but it does not prevent endpoints or local software from recording the complete URL. Consequently, components that legitimately observe request URLs but are not intended to receive authentication credentials may acquire the Exa API key. ### Attack Path 1. A user follows the documented setup and configures the MCP endpoint with a valid Exa API key in the `exaApiKey` query parameter. 2. The MCP client, a diagnostic facility, an HTTP intermediary, or a configuration-management system records or exports the complete endpoint URL. 3. An attacker obtains access to the resulting log, diagnostic bundle, configuration export, or telemetry record. 4. The attacker extracts the API key from the `exaApiKey` parameter. 5. The ...[truncated 876 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Prefer a protected authentication header, such as an authorization header, instead of placing the API key in the URL, provided that the Exa endpoint and MCP client support header-based authentication. 2. Store the credential in the MCP client's secret-management facility or an environment variable, and configure it so the resolved value is inserted only into a protected header. 3. If query-string authentication is required by the service: - Add an explicit warning that the complete endpoint URL contains a secret. - Disable or redact URL logging in MCP clients, proxies, telemetry, and diagnostic exports. - Restrict filesystem permissions on configuration files containing the resolved URL. - Prevent the URL from being committed to source control or included in support bundles. - Use a dedicated, least-privileged API key and rotate it regularly. 4. Revoke and replace any API key that may already have appeared in logs, configuration exports, screenshots, or telemetry. 5. Update troubleshooting guidance so users share only redacted URLs, for example by replacing the key value with `[REDACTED]`. ]]>