I scanned my own laptop: 6 AI agents, 14 MCP servers, 12 unpinned, 5 plaintext keys

Description and use

Six AI agents on a laptop were using 14 MCP servers, most of which were unpinned, and API keys were stored in plaintext. After scanning and remediation, package versions were pinned, secrets moved to a keychain, and a policy gate was added to restrict sensitive paths.

Problem

Multiple AI agents on a single laptop were using unpinned MCP servers and storing API keys in plaintext, exposing them to supply‑chain attacks and accidental leakage.

Outcome

After remediation, the laptop’s AI agents no longer expose unpinned MCP packages or plaintext API keys, reducing supply‑chain and credential leakage risk.

Workflow

• 1. Run a read‑only scanner (pod scan) to inventory all MCP servers and secret locations.
• 2. Identify unpinned packages and plaintext tokens.
• 3. Pin MCP package versions (e.g., npx -y [email protected]).
• 4. Remove tokens from config files and store them in a keychain or secret manager.
• 5. Implement a policy layer that denies access to sensitive paths, blocks secret output, and hash‑chains tool calls for audit.

Evidence

12 of the 14 MCP servers are unpinned

Source

five API keys sit in plaintext in agent config files

Source

Pin versions. Move secrets to a keychain. Put a gate in front of tool calls.

Source