skills.rest
RedHatProductSecurity
RedHatProductSecurityOFFICIAL
Explore all skills by this author →
Website𝕏@RedHatSecurityGitHub

no-credential-forwarding

Enforce separate non-user credentials for downstream API access in MCP servers.

47|5|Updated Apr 25, 2026
Search Tags:#security#api#oauth#audit#mcp#credentials
One-click install
npx skills add https://github.com/RedHatProductSecurity/prodsec-skills --skill no-credential-forwarding
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: no-credential-forwarding
Source: https://github.com/RedHatProductSecurity/prodsec-skills/tree/main/module/skills/no-credential-forwarding
Command: npx skills add https://github.com/RedHatProductSecurity/prodsec-skills --skill no-credential-forwarding

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes references (resource) components.

What problem does it solve?

This Skill prevents MCP servers from forwarding user credentials or tokens, reducing security risks associated with token leaks and misuse.

Core Features & Use Cases

  • Defense Against Credential Leakage: Ensures MCP servers do not pass user tokens to third-party tools or APIs, safeguarding user data.
  • Secure Integration Practices: Guides developers to implement OAuth flows and service accounts for external access.
  • Use Case: When building or auditing MCP integrations, verify that credentials are obtained via secure methods rather than forwarding user tokens, ensuring compliance with security standards.

Quick Start

Use the no-credential-forwarding skill to review MCP server code for proper credential handling practices.

Frequently Asked Questions about no-credential-forwarding

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I prevent MCP servers from forwarding user credentials to downstream APIs?▼

To prevent credential forwarding in MCP servers, enforce the use of separate, non-user credentials like service accounts for downstream API access. This blocks user tokens from reaching third-party tools, mitigating token leakage risks during integrations.

What is credential forwarding in MCP integrations and why is it a security risk?▼

Credential forwarding in MCP integrations occurs when user tokens are passed directly to third-party APIs, exposing them to interception and misuse. This practice creates severe security risks by leaking sensitive user data beyond its intended authorization scope.

How do I audit MCP server code for secure OAuth and API key handling?▼

Audit MCP server code by reviewing OAuth flows and API key management to verify credentials are obtained via secure methods. Ensure the implementation uses separate service credentials rather than forwarding user tokens to external services.

Do I need OAuth knowledge to secure MCP server integrations against token leaks?▼

Yes, securing MCP server integrations requires knowledge of OAuth, API keys, and secure credential management standards. This foundational knowledge is necessary to implement proper service accounts and prevent token forwarding vulnerabilities.

What are the limitations of using user tokens for downstream API access in MCP servers?▼

Using user tokens for downstream API access in MCP servers limits security compliance and increases token leak vulnerabilities. This approach fails to safeguard user data because it exposes credentials to third-party tools without proper isolation.

Related Skills

AbdullahMalik17AbdullahMalik17
9

configuring-better-auth

Configure OAuth 2.1 and OIDC authentication with Better Auth and MCP.

Community
Advanced
RedHatProductSecurityRedHatProductSecurity
47

protected-resource-metadata

Implement or review OAuth 2.0 Protected Resource Metadata in MCP servers.

Official
Intermediate
framerslabframerslab

account-manager

Automate social account registration, profile optimization, and credential management across platforms.

Official
Advanced
CsHengCsHeng
10

security-guardrails

Apply security guardrails for credential management and secret rotation across services.

Community
Advanced