MCP01 Token Mismanagement
A deliberately vulnerable MCP server demonstrating API key exposure through hardcoding, plaintext logging, and returning secrets to the model, part of the OWASP MCP Top 10 security lab.
README
MCP01 — Token Mismanagement & Secret Exposure
Part of the MCP Security Lab,a deliberately vulnerable and secured MCP reference based on the OWASP MCP Top 10.
The vulnerability
This example shows how API keys can be exposed if they're not handled properly.
The vulnerable tool leaks the API key in three ways:
- Hardcoded in the code – The API key is stored directly in the source code, so anyone with access to the repository can see it.
- Logged in plain text – Every request logs the
Authorizationheader, exposing the API key in application logs. - Returned to the model – The tool includes the API key in its response, making it available in the model's context where it could be exposed again.
Run it
Install the requirements:
pip install -r ../requirements.txt
Run the vulnerable example:
cd exploit
python exploit.py
Run the secured example:
$env:PAYMENTS_API_KEY = "REPLACE_WITH_KEY_FROM_YOUR_SECRETS_MANAGER"
python exploit_vs_secured.py
The fix
| Vulnerability | Fix
| Hardcoded API key | Store the key in an environment variable instead of the source code. |
| Plaintext logging | Filter or mask API keys before writing logs. |
| Secret returned to the model | Keep the API key inside the PaymentsClient so the tool never sees or returns it. |
The main idea is simple: the model doesn't need the API key, so don't expose it. Load it only when needed, use it, and keep it away from logs, responses, and source code.
mcp-security-lab
Recommended Servers
playwright-mcp
A Model Context Protocol server that enables LLMs to interact with web pages through structured accessibility snapshots without requiring vision models or screenshots.
Magic Component Platform (MCP)
An AI-powered tool that generates modern UI components from natural language descriptions, integrating with popular IDEs to streamline UI development workflow.
Audiense Insights MCP Server
Enables interaction with Audiense Insights accounts via the Model Context Protocol, facilitating the extraction and analysis of marketing insights and audience data including demographics, behavior, and influencer engagement.
VeyraX MCP
Single MCP tool to connect all your favorite tools: Gmail, Calendar and 40 more.
graphlit-mcp-server
The Model Context Protocol (MCP) Server enables integration between MCP clients and the Graphlit service. Ingest anything from Slack to Gmail to podcast feeds, in addition to web crawling, into a Graphlit project - and then retrieve relevant contents from the MCP client.
Kagi MCP Server
An MCP server that integrates Kagi search capabilities with Claude AI, enabling Claude to perform real-time web searches when answering questions that require up-to-date information.
E2B
Using MCP to run code via e2b.
Neon Database
MCP server for interacting with Neon Management API and databases
Exa Search
A Model Context Protocol (MCP) server lets AI assistants like Claude use the Exa AI Search API for web searches. This setup allows AI models to get real-time web information in a safe and controlled way.
Qdrant Server
This repository is an example of how to create a MCP server for Qdrant, a vector search engine.