MCP030 raises a critical finding on the word credentials in a resource description

[royalpinto007]

Desired outcome

MCP030 does not raise a critical finding because of wording in a resource's description.

Why it matters

resourceExposesSecrets in src/rules/secrets.ts builds its haystack from three fields and matches with plain substring containment:

const haystack = `${res.uri} ${res.name ?? ""} ${res.description ?? ""}`;
const hit = containsAny(haystack, SECRET_PATH_PATTERNS);

SECRET_PATH_PATTERNS in src/rules/helpers.ts includes generic words such as credentials and secrets, and containsAny lowercases and calls includes. So a resource whose description reads "Project notes. Contains no credentials." is reported as critical with the message "Resource ... references 'credentials', which commonly holds secrets or system credentials." The more carefully a server author documents what a resource does not expose, the more likely they are to be flagged.

critical is the highest severity in the tool, and exceedsThreshold in src/engine/engine.ts means a single one can fail a CI run. A false critical derived from prose is exactly the finding that gets the whole tool disabled in someone's pipeline.

The URI is where the actual risk lives. A resource pointing at file:///home/me/.env is a real problem; a description that mentions the word "secrets" is not, on its own.

Steps

1. Match res.uri against the full SECRET_PATH_PATTERNS list, since a path pattern in a URI is genuine evidence.
2. For res.name and res.description, either skip them or match only the unambiguous file patterns (.env, id_rsa, id_ed25519, /etc/passwd, /etc/shadow, .pem) and report at a lower severity, since prose is a weak signal.
3. Add a test in test/rules.test.ts with a resource whose description contains "no credentials" and assert no critical finding.
4. Worth documenting the split in the rule's description so users understand why a URI hit and a prose hit are scored differently.

Claiming this

Comment below to claim it. A reply usually comes within a day.