AGENTFORCE-MCP-09: MCP Server Hardcoded Secrets / PII

🚨 Critical · MCP Supply Chain

Detects hardcoded credentials, API keys, or confidential PII resources inside MCP server source.

Details

Field	Value
Rule ID	AGENTFORCE-MCP-09
Severity	Critical
Category	MCP Supply Chain

Remediation

Move secrets to environment variables or a secret manager. Do not embed credentials in tool/resource payloads.

See Also

• Rule catalog index
• Scanning basics
• SARIF output