Cyber Risks · Trail of Bits Blog

Insecure credential storage plagues MCP

Summary: Trail of Bits found that many MCP environments store long-term API keys for third-party services in plaintext on the local filesystem, often with world-readable permissions, across tools including official servers for GitLab, Postgres, and Google Maps and third-party tools like the Figma connector and Superargs wrapper. The blog details how Claude Desktop's claude_desktop_config.json on macOS carries -rw-r--r-- permissions, how Cursor and Windsurf store conversation logs with world-readable permissions, and how the Figma server writes tokens via Node.js's fs.writeFileSync with default 0666 permissions.

What's compelling: A single file disclosure vulnerability is all an attacker needs to read these keys and take over the entirety of the connected third-party service - no complex exploit required, and any process or user on the system can read the file without special privileges.

Read the original at Trail of Bits Blog ↗