MCP01 — Token Mismanagement & Secret Exposure

Part of the MCP Security Lab,a deliberately vulnerable and secured MCP reference based on the OWASP MCP Top 10.

The vulnerability

This example shows how API keys can be exposed if they're not handled properly.

The vulnerable tool leaks the API key in three ways:

1. Hardcoded in the code – The API key is stored directly in the source code, so anyone with access to the repository can see it.
2. Logged in plain text – Every request logs the Authorization header, exposing the API key in application logs.
3. Returned to the model – The tool includes the API key in its response, making it available in the model's context where it could be exposed again.

Run it

Install the requirements:

pip install -r ../requirements.txt

Run the vulnerable example:

cd exploit
python exploit.py

Run the secured example:

$env:PAYMENTS_API_KEY = "REPLACE_WITH_KEY_FROM_YOUR_SECRETS_MANAGER"
python exploit_vs_secured.py

The fix

| Vulnerability | Fix

| Hardcoded API key | Store the key in an environment variable instead of the source code. | | Plaintext logging | Filter or mask API keys before writing logs. | | Secret returned to the model | Keep the API key inside the PaymentsClient so the tool never sees or returns it. |

The main idea is simple: the model doesn't need the API key, so don't expose it. Load it only when needed, use it, and keep it away from logs, responses, and source code.

mcp-security-lab