---
id: 1403
title: "Insecure credential storage plagues MCP"
source_domain: blog.trailofbits.com
source_url: "https://blog.trailofbits.com/2025/04/30/insecure-credential-storage-plagues-mcp/"
published_at: "2025-04-30 07:00"
tags: ["mcp", "secrets-management", "llm-security", "vulnerabilities", "trail-of-bits", "credential-storage", "api-keys"]
phying_url: "https://phying.com/item/1403"
lang: en
---

# Insecure credential storage plagues MCP

## Summary

This post describes how many examples of MCP software store long-term API keys for third-party services in plaintext on the local filesystem, often with insecure, world-readable permissions.

## Intelligence Metadata

- **Sources:** blog.trailofbits.com
- **Published:** 2025-04-30 07:00
- **Original:** https://blog.trailofbits.com/2025/04/30/insecure-credential-storage-plagues-mcp/
- **Phying News:** https://phying.com/item/1403