GATE002: Credential passed in command arguments

A token or password is passed on an MCP server command line, where it is visible to every process on the machine.

Name
Severity
Type
High
Description
Default severity. An individual finding may be reported higher or lower when the surrounding configuration justifies it.
Name
Capabilities
Type
secrets
Description
Capability classes this rule reasons about.
Name
Explain locally
Type
gate explain GATE002
Description
The same text, in your terminal, with no network access.

What Gate detected

Gate found credential material inside the args array of an MCP server, either as --token abc123, --token=abc123, or as a recognisable secret shape anywhere in an argument.

Command-line arguments are not private. On Linux and macOS any user on the machine can read them from /proc or ps; on Windows they are visible through WMI. They are captured by process monitors, crash reporters, container runtimes, and CI logs. A credential passed as an argument leaks to every observer of the machine, not just to the agent.

Example

This is the shape of configuration that triggers the rule.

{
  "mcpServers": {
    "db": {
      "command": "mcp-postgres",
      "args": ["--connection-string", "postgres://app:hunter2@db.internal:5432/app"]
    }
  }
}

Remediation

Move the credential into the server's env block as an environment reference, or have the server read it from a secret manager. Environment variables are not perfect, but they are not printed by ps.

Suppressing this rule

If this finding is acceptable in your repository, record why alongside the suppression:

gate.config.ts

export default defineConfig({
  ignore: [
    {
      rule: 'GATE002',
      reason: 'Why this is acceptable here',
    },
  ],
})

Gate refuses to apply an ignore entry with no reason. The reason is the only thing that will tell the next person whether the suppression is still true.