MCP Servers: A New Frontier for Enterprise Secrets Exposure

The rapid adoption of AI agents in the enterprise has introduced a new security challenge: the Model Context Protocol (MCP) servers that connect these agents to critical systems often hold the keys to the kingdom. A recent analysis highlights how MCP servers can expose enterprise secrets through plaintext configuration files, over-permissioned access, and prompt injection, often before security teams even realize the server is running.

MCP, an open standard originally introduced by Anthropic, allows AI assistants to connect to external tools and data. The MCP server acts as a middleman, requiring credentials to access systems, which turns AI agents into active identities operating across the enterprise. This means a leaked secret doesn’t just expose data; it grants an attacker the ability to act on it.

Common exposure paths include plaintext credentials in config files, credential sprawl across ungoverned servers, prompt injection attacks, over-permissioning, and the risk of connecting to untrusted MCP servers. A notable example is CVE-2025-6514, a vulnerability in the mcp-remote OAuth proxy that could allow a malicious server to trigger OS command injection, leading to remote code execution and credential theft.

To mitigate these risks, organizations should centralize secrets management, use short-lived credentials with automatic rotation, enforce least privilege, keep a human in the loop for sensitive actions, encrypt secrets with a zero-trust model, log and audit all agent activity, and maintain an inventory of MCP servers. Tools like Keeper Secrets Manager can help by masking secrets by default and requiring confirmation before revealing values.

As MCP becomes a new layer in the enterprise, applying rigorous security measures is essential to protect the credentials that AI agents now hold.