Static Credentials Expose MCP Servers to Risk

Tools developers use to connect artificial intelligence tools with external applications and data sources typically are secured by static credentials such as API keys and personal access tokens, exposing AI agent systems to theft or misuse, research shows.

See Also: AI Agents Demand Scalable Identity Security Frameworks

Astrix Research examined more than 5,200 open-source model context protocol server implementations to understand how their developers manage authentication. It found that 88% of servers require credentials, but more than half depend on long-lived, static secrets instead of short-lived or delegated access tokens. Only a fraction use OAuth, the standard protocol for secure authorization.

MCP servers act as intermediaries between AI models and external systems, allowing them to retrieve information and perform actions. But the way credentials are handled – often stored directly in configuration files or passed as environment variables – creates opportunities for unauthorized access if those machines are compromised.

Researchers traced the issue back to the protocol’s early days. When Anthropic introduced MCP in 2023, sample servers used to demonstrate its capabilities relied on personal access tokens and basic passwords. Although later examples corrected these defaults, the original patterns persisted across community-built projects.

MCP has expanded into thousands of open-source implementations. Astrix estimated around 20,000 repositories on GitHub contain some form of MCP server code.

Static credentials are risky because they rarely expire or rotate and are often shared between services. Once exposed, they can grant prolonged, unrestricted access to connected systems. The report said that nearly 80% of servers that used API keys obtained them through environment variables, which is a common practice that offers convenience but little isolation.

Other security researchers have raised similar warnings. Backslash Research previously found that several publicly listed MCP servers were configured to accept commands from any network interface, enabling attackers to execute code remotely. Separate academic work has shown how weak access controls in MCP can be exploited to move laterally across systems or extract data without direct user interaction.