Your MCP Config Is Leaking Secrets

Open up the claude_desktop_config.json or mcp.json of the average AI tinkerer right now and tell me you don&rsquo;t flinch. API keys sitting in plaintext. GitHub PATs with repo scope pasted next to a GitLab token that somebody will forget about in six months. A Slack bot token that absolutely should not be in a file backed up to iCloud. We collectively spent a decade teaching engineers not to do…