How coding agents and MCP servers leak secrets
Coding agents such as Claude Code, Cursor and Copilot read a developer’s files, run commands and call tools on their own. MCP servers connect them to company systems: the issue tracker, the database, the cloud account. That makes them very useful, and it gives them the same reach as the developer, including to API keys, credentials and source code.
How does a coding agent leak a secret?
Usually, nobody intends it. Some common ways:
- The secret goes into the prompt. The agent reads a configuration file to understand a bug, and the file holds an API key. The whole file goes to the model.
- The agent is told to send it. A prompt injection in a web page, an issue or a package’s README tells the agent to read credentials and send them somewhere.
- A tool result carries it out. An MCP server returns data the agent then pastes into another tool, or into a public place such as a pull request comment.
- A script does it. The agent writes and runs a script that uploads a file, and the upload goes to a host nobody has seen before.
What is MCP, and why does it matter here?
The Model Context Protocol (MCP) is a standard way for AI tools to call outside tools and data sources. An MCP server might read tickets, query a database or post messages. Each call is a place where data can come in, which may be untrusted, or go out, which may be sensitive.
How to keep secrets in
- Keep secret stores closed to AI tools. SSH keys, cloud credentials and password stores shouldn’t be readable by an agent at all.
- Remember what was read. If an agent did read something sensitive, limit where that session may send afterwards.
- Check what the model asks for. A model’s tool call to upload a file or run a network command can be cancelled before the agent runs it.
- Check MCP calls and responses, and treat results from untrusted servers as untrusted input.
- Don’t break normal work. Reading from GitHub or a package registry, SSH and
git pushshould keep working.
How Snowfence does it
Snowfence runs coding agents in a sandbox on the laptop or server. Protected files, such as SSH keys and credentials, stay closed to them. Every MCP call and response passes a gateway, and every request to an AI model service is read on the machine, so a dangerous tool call in the model’s reply is cancelled before the agent sees it.
If an agent does read sensitive data, Snowfence marks that session, and it may then only send to places approved for that data. Text from the model streams through with no delay, and package installs, git push and SSH keep working. When a developer does something unusual, Snowfence asks rather than blocks.
What Snowfence can’t stop
Agents that run entirely in a vendor’s cloud act on the vendor’s computers, not the company’s own machines. Snowfence controls who signs in to them and can report what access they’ve been given, but it can’t check what they do there.
Related
Updated