Committing a Codex MCP config? 1 in 8 credential slots in public MCP files hold a real secret, so use env vars

#What changed

Hush Security looked at roughly 82,000 public MCP configuration files on GitHub, the files that coding agents including OpenAI Codex, Claude Code, Cursor and VS Code read to connect to tools. In 12% of credential slots the value was a hardcoded secret rather than a reference. 55% of those secrets had no vendor-recognizable token shape, so pattern scanners like gitleaks or GitHub secret scanning can miss them. Among leaked credentials with a known scope, 53% were organization-, workspace- or database-wide, and 24% of all hardcoded secrets were both broad-scope and non-expiring. Across 7,681 credential-bearing configs, 243 had removed the secret from the file but still exposed it in earlier Git commits. The study was flagged again this week by Bot News Network on X; the original research came out September 17.

#Who is affected

Anyone who shares a project .codex/config.toml (or another agent's MCP file) through Git, especially in public repos. Unlike a .env file, these configs are meant to be committed so a team shares the same tools, which is exactly why keys end up in them.

#What to do now

• Keep literal tokens out of [mcp_servers.*] tables. Per the Codex MCP docs, stdio servers can forward variables with env_vars = ["MY_TOKEN"], and HTTP servers can read a token with bearer_token_env_var or map headers with env_http_headers.
• Prefer OAuth where the server supports it (codex mcp login <server>), so no long-lived key lives in the file.
• Watch codex mcp add ... --env KEY=VALUE: that writes the value into config.toml. Use it in your personal ~/.codex/config.toml, not a committed project file.
• If a key was ever committed, rotate it at the provider. Deleting the line does not remove it from Git history.

#What is not confirmed

All figures are Hush Security's own, and Hush sells tooling for this problem. They call the sample a lower bound (GitHub code search covers default branches and skips forks) and checked credential shapes, not whether keys still work. No exploitation of these credentials is reported. The Codex settings above were checked against the official docs; the study's numbers were not independently verified by DotsFeed.