Skip to main content
Rule ID: AE-SEC-002 · Severity: Blocker · Category: Secrets · Auto-fixable: No
Charter never auto-fixes secret findings. Removing the literal value is not a complete fix — rotate the credential externally first. Assume it was exposed the moment it was committed.

​
Why this rule

MCP configurations are read by the agent runtime before tools execute. Unlike source code that may only be read occasionally, MCP configs are intentionally agent-visible by design — every tool invocation passes through them (see the MCP safety model). A raw credential here is exposed to every model, every session, and every tool-call log that processes this context.

​
What triggers it

Charter scans tracked MCP configuration files for the same high-confidence credential patterns as AE-SEC-001: Scanned files: .mcp.json, mcp.json, .cursor/mcp.json, .vscode/mcp.json, .claude/settings.json, claude_desktop_config.json, cline_mcp_settings.json, and any *.pkl file whose path contains mcp or config. Only literal credential values trigger the finding. Detected values are redacted in Charter output (first 4 characters followed by …).

​
Examples

.mcp.json

​
How to fix

1

Rotate the credential externally

Revoke and regenerate the secret in the provider’s dashboard before touching any files. The commit that introduced the literal value exposed it.
2

Remove the literal value from the MCP config

Delete the raw credential from the header value in the config file.
3

Replace with an environment variable reference

Use ${MCP_API_KEY} or $MCP_API_KEY in place of the literal value. Most MCP runtimes (npx, uvx) resolve environment variables at tool invocation time.
4

Commit the fix

Commit the updated config file. Charter re-scans on next run and clears the finding once no literal credential is detected.
5

If the secret is already in git history

The credential is compromised. Rotate first, then consider a history rewrite (git filter-repo) — coordinate with all collaborators before rewriting shared history.

​
Score impact

Blocker (−20 per finding) with a raw-secret cap: the final score is held at ≤49 while AE-SEC-001 or AE-SEC-002 is active. This overrides the base formula. Caps are reserved for raw-secret and Blocker findings.
Use env var references in MCP auth headers. Most MCP runtimes resolve environment variables at tool invocation time — the credential never needs to live in the config file itself.

​
Edge cases

Environment variable references (${VAR}, $VAR) and placeholder strings (your-api-key-here) are explicitly excluded — only literal credential values trigger the finding. Only git-tracked files are in scope.

AE-SEC-001

Same patterns applied to agent context files.

AE-MCP-001

MCP servers must be pinned to exact versions.

AE-MCP-003

Remote MCP servers must declare auth.

​
CLI