AG-MCP-TOKENLEAK: LLM API Key Passed to MCP Server

What this rule means

An MCP server configuration passes the user's own LLM API key into the server's environment. A compromised or malicious MCP server can then make calls under the user's account — billing, rate limits, and data exposure all happen invisibly, with no user consent step.

Why it matters

NSA guidance (May 2026) warned that 200,000+ MCP server instances are running with weak or absent access controls, of which credential-passing configs are a common variant.

How to fix it

Never pass the user's LLM API key to an MCP server. If the server needs LLM access, issue it its own scoped, rate-limited, audience-bound key (RFC 8707).

Detect it

pip install lucin
lucin scan .                  # all rules
lucin explain AG-MCP-TOKENLEAK          # this rule, in your terminal

Findings carry a file:line and, where the rule supports it, a witness path showing the flow that triggered it. Precision and recall for the whole rule set, with the commands that regenerate them, are on the benchmarks page — and the gaps are on limits.

← All detection rules