S3E3 - MCP: Model Credential Problems

Let's start by thinking about how most organizations actually deploy MCP servers.

Your team wants to connect an AI assistant to Slack.

Reasonable enough.

You summarize the channels, search message history, and maybe draft responses.

You find a popular open source MCP server with thousands of stars on GitHub.

Very reasonable.

You start looking at the setup documentation, which walks you through it.

You open up Chrome, navigate to developer tools, go to the application tab, then select cookies and find the cookie labeled the letter D and copy its value.

Then you have to copy that value into a JSON configuration file on your local machine.

You've just extracted a session token from your browser and stored it in plain text on your machine.

That token doesn't expire when you close the browser.

It doesn't rotate automatically.

It sits in a config file that any process on your machine can read, including that VS Code extension you installed last week or the MCP servers you're about to run.

And here's the thing.

This isn't some sketchy underground tool.

This is a documented setup process for widely used MCP integrations.

And as we saw with the Slack MCP server, other calendar integrations and email connectors, the ecosystem has normalized credential extraction as a setup step.

Now multiply that across your organization.

Every developer who's curious about AI tooling, every proof of concept that never got a security review, and every config file sitting in a home directory somewhere.

That's your actual attack surface, and it's probably not in your asset inventory or risk register.