79% of API keys found in open-source MCP server implementations are passed via simple environment variables.

53% of open-source Model Context Protocol (MCP) server implementations rely on insecure, long-lived static secrets, such as API keys and Personal Access Tokens (PATs).

27% of high-risk sensitive files contain digital data such as API keys, usernames, and account numbers