no-credential-leak-in-tool

CWE: CWE-200, CWE-526, CWE-441 OWASP: A01:2021 – Broken Access Control

Detects process.env returned in a tool result, the caller's bearer token (authInfo.token) returned to the model, and that token forwarded to another service. This rule is part of eslint-plugin-mcp-sdk-security.

💼 This rule is set to error in the recommended and strict configs.

Quick SummaryCopy Anchor Link

Why this mattersCopy Anchor Link

A tool result is read by the model, written to the host's logs, and can be echoed into any later tool call the model is steered into making. Anything a handler returns should be treated as published to whoever can influence the model.

Relationship to other pluginsCopy Anchor Link

None overlap. Neither the tool-result channel nor the SDK's AuthInfo exists outside MCP, and node-security / secure-coding have no rule for either.

❌ IncorrectCopy Anchor Link

// ❌ every credential the server holds, handed to the model
server.registerTool('debug_env', cfg, async () => ({
  content: [{ type: 'text', text: JSON.stringify(process.env, null, 2) }],
}));

// ❌ the model chooses which variable to read
server.registerTool('get_env', cfg, async ({ name }) => ({
  content: [{ type: 'text', text: String(process.env[name]) }],
}));

// ❌ token passthrough
server.registerTool('list_repos', cfg, async (args, extra) =>
  fetch('https://api.github.com/user/repos', {
    headers: { Authorization: `Bearer ${extra.authInfo.token}` },
  }),
);

How results, tokens and requests are recognisedCopy Anchor Link

• Results are every value a tool handler (or ResourceTemplate callback) returns, followed through same-file bindings.
• process.env is the global process (unless shadowed) or node:process's export. Reading one named variable — process.env.NODE_ENV — is not reported: whether it is secret is not something a name can prove.
• authInfo is read from the request context the SDK passes each handler: the second parameter when the tool declares an input schema, the first when it does not, and the second of a setRequestHandler(CallToolRequestSchema) handler. Its token is followed through destructuring, bindings, templates and JSON.stringify(authInfo).
• Outbound requests are the clients no-ssrf-in-tool resolves (fetch, axios, got, undici, node-fetch, http(s)), plus the SDK's StreamableHTTPClientTransport and SSEClientTransport. Every argument is searched, including nested headers objects and arrays.

✅ CorrectCopy Anchor Link

// ✅ report what the token grants, not the token
server.registerTool('whoami', cfg, async (args, { authInfo }) => ({
  content: [
    {
      type: 'text',
      text: `${authInfo?.clientId}: ${authInfo?.scopes.join(', ')}`,
    },
  ],
}));

// ✅ call downstream with a credential issued to this server
server.registerTool('list_repos', cfg, async (args, extra) => {
  const token = await exchangeForGitHubToken(extra.authInfo);
  return fetch('https://api.github.com/user/repos', {
    headers: { Authorization: `Bearer ${token}` },
  });
});

What this rule deliberately does not reportCopy Anchor Link

• One named environment variable in a result.
• The variable names — Object.keys(process.env) lists names, not values.
• Test files (*.test.ts, test/, e2e/, fixtures/, …): a fixture server reporting its own environment ships nothing.
• The server's own credentials sent downstream (process.env.SERVICE_TOKEN).
• Other authInfo fields — clientId, scopes, expiresAt.
• A token exchanged by a call this rule cannot see into: the result of that call is a different token.
• A file that imports no MCP server package.

When Not To Use ItCopy Anchor Link

A debugging tool that deliberately reports configuration should return a fixed list of non-secret keys instead, so this rule has no options.

Further ReadingCopy Anchor Link

• MCP Security Best Practices: Token Passthrough
• CWE-526: Exposure of Sensitive Information Through Environmental Variables
• CWE-441: Unintended Proxy or Intermediary (Confused Deputy)