Raw Provider Key While a Gateway Route Exists

When this rule triggers

The configuration holds a raw key for an MCP server or provider that this workspace routes through the Gateway. This check runs only in a workspace scan that knows the workspace's Gateway routes; the key value is never shown.

How to fix

Replace the raw key with the agent's Gateway credential and point the server or provider at the Gateway route. Rotate the exposed key, because it has been present in a configuration.

Example change

env: { GITHUB_TOKEN: <raw key> } on a server the Gateway already routes → use the agent's Gateway credential and the Gateway route

Verify the change

Rescan in the workspace after the change. The finding clears when the server has no raw key, or uses a Gateway credential.