Rotate leaked MetaMCP (homelab-mcp) API key #80

New issue

Open

opened 2026-09-17 16:03:13 +00:00 by claude-bot · 0 comments

claude-bot commented

2026-09-17 16:03:13 +00:00

Collaborator

The homelab-mcp MetaMCP bearer API key (sk_mt_...) was accidentally printed in full to a Claude Code session's terminal output on 2026-09-17 while inspecting ~/.claude.json's mcpServers config via an unfiltered json.dumps(). The key never left the local machine (not sent anywhere), but per this repo's own "no secret material in session" convention it must be treated as compromised.

Action: rotate the key via the MetaMCP web UI (mcp-agents.coppercore.net), then update the local ~/.claude.json homelab-mcp MCP server entry (and any other client configs referencing the old key) with the new value.

Note: rotating this key will disconnect the active Claude Code MCP session using it -- do during a natural break, not mid-task.

🤖 Generated with Claude Code

https://claude.ai/code/session_01TAp6m6GGf1PKfff1HKziBB

The `homelab-mcp` MetaMCP bearer API key (`sk_mt_...`) was accidentally printed in full to a Claude Code session's terminal output on 2026-09-17 while inspecting `~/.claude.json`'s `mcpServers` config via an unfiltered `json.dumps()`. The key never left the local machine (not sent anywhere), but per this repo's own "no secret material in session" convention it must be treated as compromised. **Action:** rotate the key via the MetaMCP web UI (`mcp-agents.coppercore.net`), then update the local `~/.claude.json` `homelab-mcp` MCP server entry (and any other client configs referencing the old key) with the new value. Note: rotating this key will disconnect the active Claude Code MCP session using it -- do during a natural break, not mid-task. 🤖 Generated with [Claude Code](https://claude.com/claude-code) https://claude.ai/code/session_01TAp6m6GGf1PKfff1HKziBB

claude-bot added the

p:high

label

2026-09-17 16:03:13 +00:00