Free tools Windows power users keep installed
One-click scans. No signup required.
If an MCP integration exposes a credential or sensitive data, treat it as an active security incident: stop or isolate the affected connection, revoke exposed credentials, preserve and review evidence, then restore service with new safeguards. Do not assume deleting a config entry or log line makes a secret safe; it may already have been copied, cached, or used.
1. Contain the exposure
Limit further access before investigating. Disable the affected integration, server, or tunnel if you can do so safely, and detach connected upstream MCP servers while you assess the incident. If the integration cannot be stopped immediately, restrict its network access or permissions through the controls available in that product.
As an Amazon Associate I earn from qualifying purchases.
For Anthropic MCP tunnels specifically, Anthropic’s MCP tunnels security guidance says to stop the tunnel stack and remove upstream servers from Managed Agent sessions or API requests. Those steps apply to Anthropic’s tunnel deployment, which its documentation labels a research preview; other MCP products may have different controls.
Recommended Free Tools
2. Revoke and replace exposed credentials
Revoke or invalidate any exposed API key, access token, refresh token, OAuth credential, or certificate through the provider that issued it. Replace it with a new credential rather than simply editing the visible configuration. OWASP’s MCP01:2025 Token Mismanagement and Secret Exposure states: “Rotate and invalidate all tokens immediately upon suspected exposure.”
#1 Best Overall
- POWERFUL SECURITY KEY: The Security Key C NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key C NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key C NFC via USB-C and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
Where a credential grants access to several services, identify each affected account or integration and revoke the credential at its issuer. If you cannot confirm whether a secret was accessed, treat it as exposed. A stolen token can let someone make requests that appear legitimate to the protected service, as the Model Context Protocol explains in its Authorization Security Considerations.
For Anthropic MCP tunnels, the documented sequence calls for provisioning a fresh tunnel and rotating downstream OAuth tokens. Follow the provider’s instructions for that deployment rather than treating its tunnel-specific procedure as universal.
Rank #2
- POWERFUL SECURITY KEY: The YubiKey 5C NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5C NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5C NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
3. Find where the data may have persisted
Map the paths the affected integration used, not only the file or screen where you first spotted the secret. OWASP identifies MCP configuration, environment and build-time handling, prompts and model context, caches, telemetry, logs, and vector or shared-context stores as possible exposure locations. A credential found in any of these places should be considered potentially exposed.
Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minuteWindows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstall- Check MCP client and server configuration, environment variables, deployment manifests, and build output.
- Review prompts, conversation or model context, memory, caches, vector stores, and shared context that may have received the value.
- Inspect application, proxy, cloud, telemetry, and connected-service logs for credentials or sensitive content.
- Determine whether copies may exist in backups, debugging output, support records, or other systems governed by your incident process.
OWASP recommends auditing how credentials flow among clients, tools, memory, and context caches. Remove or restrict exposed copies where possible, but do not treat cleanup as a substitute for revocation: a copy may have been obtained before deletion.
Rank #3
- POWERFUL SECURITY KEY: The YubiKey 5 NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5 NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5 NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
4. Investigate activity before bringing the integration back
Review logs covering the suspected exposure period, including proxy, cloudflared, MCP server, and connected-service records where applicable. Look for unusual requests, unexpected access to integrated services, unfamiliar source locations, or activity outside the integration’s normal pattern. Preserve relevant evidence under your organization’s incident-handling process before logs rotate or are changed.
Anthropic advises reviewing relevant logs before bringing a new tunnel online. The exact log sources and retention available will depend on your deployment. If records are incomplete, note that uncertainty in the incident assessment rather than assuming that the credential was unused.
Rank #4
- POWERFUL SECURITY KEY: The Security Key NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key NFC via USB-A and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
5. Restore with safer credentials and authorization
Reconnect only after you have contained the exposure, replaced affected credentials, and reviewed available evidence. Provision a fresh integration or tunnel if needed, then give it new credentials with only the permissions required for its job.
Quick wins for a faster PC:
Scan for outdated or missing drivers - takes under a minuteDriver Scan →Repair Windows errors before they cause bigger problemsFix Now →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →- Store secrets in a secure vault or secrets manager and inject them at runtime rather than embedding them in prompts, source code, or build artifacts. OWASP discusses these controls in its MCP01 guidance and MCP Security Cheat Sheet.
- Use short-lived tokens where the issuer and integration support them, and confirm that you can revoke credentials promptly.
- Ensure the MCP server validates that a token was issued for that server. Do not pass a client’s token through to an upstream API; use separate credentials appropriate to the upstream service. The MCP specification’s Authorization Security Considerations and Security Best Practices describe audience validation and token-passthrough risks.
- Redact or mask secrets and sensitive values before logs and telemetry are written, and verify that prompts and context stores are not retaining them without appropriate controls.
6. Monitor the restored service and handle reporting obligations
After reconnection, watch for recurring unusual traffic and confirm that credentials or sensitive data are no longer appearing in prompts, logs, or telemetry without controls. Keep the new credential’s permissions narrow and maintain a clear revocation path.
Best Value
- POWERFUL SECURITY KEY: The YubiKey 5 is a versatile physical passkey that protects your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5 secures 100+ of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5 via USB and tap it to authenticate. No batteries, no internet connection, and no extra fees required.
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
Technical containment does not determine whether an incident triggers legal, privacy, contractual, or customer-notification duties. Those obligations depend on the jurisdiction, data involved, contracts, and incident facts; assess them through your organization’s established incident process.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
