Keeping credentials out of MCP configs
Why it matters
An MCP config committed with a token in it publishes that token. Reference an environment variable instead.
How to fix it
Does your repository pass this check?
Free for public GitHub repositories, no account needed. 50+ DevOps and security checks in about ten seconds.