Check M7 · agent surface family · severity LOW · automatic · one of the 10 MCP-server checks
Maps to OWASP LLM02 ATLAS AML.T0083 The secrets a server asks to be given end up in the agent's configuration, where ATLAS names their theft.
The question this check asks: what does this server ask you to hand it?
Most useful MCP servers need a key: an API token, a database password, an authorization header. Whatever you give the server ends up in your agent's configuration file and in the server's hands. Knowing what is asked for, before it is configured, is part of deciding whether to add it.
Every environment variable and every remote header the listing marks isSecret is named in one note, mcpr-secrets, 0 points. The names only; a listing carries no values and RepoGates stores none. It is a note because it is what an MCP server is, not a fault, so it never changes a verdict.
None by construction: a note never changes the verdict.
What the server does with a secret. Secrets the listing does not mark as secret. A key already saved in your configuration: the plugin's write guard reads text about to be written on your machine, separately from this check.
Scope, the same on every page of this roster: RepoGates does not see git clone, package managers or curl — outside Claude Code with the RepoGates plugin, whose hook refuses a clone or install that names a blocked repository on the command line, before it runs. The hook sees Bash tool calls in that one client and nothing else. On a claude mcp add line, a remote address that a listed server declares is judged with that listing's verdict riding along, and is still an ask: anyone may declare any address in a listing, and the server answering there runs on its operator's machine. A listing whose verdict is BLOCK is denied. An address no listed server declares is asked about. A server added by editing a configuration file or through /mcp is not a shell line the hook sees. Edit and Write are read for one thing only — an API key about to be saved — checked on the machine and never sent; that guard asks, it never denies. This roster reads what the official MCP registry publishes about a server — its record, its version history, the repository and packages it declares, the remote addresses it names — and never the server's code or what it does once it runs. A remote-only server is REVIEW at best, never a pass. The registry carries no download count, star count or popularity of any kind, so there is no lookalike check. A server the registry no longer serves is not assessed, never a pass. A PASS means nothing matched on what was read.
curl -s "https://registry.modelcontextprotocol.io/v0/servers/NAMESPACE%2FNAME/versions/latest" | jq '[.server.packages[]?.environmentVariables[]? | select(.isSecret) | .name]'Why is asking for a secret not a finding? Because nearly every useful server needs one. The note names what is asked so the reader can decide; it never moves the verdict.
Does RepoGates see the secret's value? No. The registry listing carries names only, and RepoGates stores names only.
Which secrets are named? Environment variables of a launched package and headers of a remote endpoint that the listing marks as secret.
M5 Remote endpoint · M8 Launch arguments · C21 Credential redirect.
Add RepoGates to Chrome Pricing
Sources for this page: the severities and weights from the product's own roster and scoring tables, and the official MCP registry's published record format. See also the MCP servers intelligence page.