{
  "description": "Regression fixture for scripts/mcp_inventory.py (fictional). Each server is a case the scanner must catch without printing a value: a key passed as a positional argument, after --key, after --pat and after -k; a key in an env name ending in PK or PAT; PostHog through mcp-remote with a Bearer value in env; a key in URL query values under neutral names; an inline X-Auth header; connection strings as a positional argument, after --dsn, in DATABASE_URL, in JDBC form and as keywords; a token in a package URL; a key in a quoted shell command and in a JSON argument; a client secret in an auth block; an unquoted TOML value, which stops the file parsing; a key in the mcp.servers block of VS Code user settings and a header in managedMcpServers. A credential file inside a second repository is judged against that repository through the per-file project key. Controls that must stay quiet: --auth oauth, a UUID after --project-id and a credential path outside the project. Values after -p, --dsn and --auth that may be names stay hidden without a finding. Also HubSpot's own packages, the project settings keys that skip the .mcp.json prompt, Google's PyPI package for Google Ads with and without a tools config, the GA4 write variable, an affected and a current mcp-remote, an envFile inside the project, plain WebSocket, and the settings that skip a person (S15). Every value is a placeholder holding exampleonly or EXAMPLE-ONLY, so one grep proves none printed; expected lines are in references/failure-modes.md.",
  "home": "/home/example",
  "project": "/home/example/acme-marketing",
  "files": [
    {
      "client": "cursor",
      "scope": "global",
      "path": "~/.cursor/mcp.json",
      "format": "json",
      "content": {
        "mcpServers": {
          "secret-positional": {"command": "npx", "args": ["-y", "example-mcp@1.0.0", "exampleonly0000notarealkey00"]},
          "secret-key-flag": {"command": "npx", "args": ["-y", "example-mcp@1.0.0", "--key", "exampleonly1111notarealkey11"]},
          "secret-pat-flag": {"command": "npx", "args": ["-y", "example-mcp@1.0.0", "--pat", "pat-na1-exampleonly-0000-0000-000000000000"]},
          "klaviyo-local-pk": {
            "command": "uvx",
            "args": ["klaviyo-mcp-server@1.0.0"],
            "env": {"KLAVIYO_PK": "pk_exampleonly0000notarealkey", "READ_ONLY": "true", "ALLOW_USER_GENERATED_CONTENT": "false"}
          },
          "snowflake-pat": {"command": "/opt/example/bin/snowflake-mcp", "env": {"SNOWFLAKE_PAT": "exampleonly2222notarealtoken22"}},
          "posthog-proxy": {
            "command": "npx",
            "args": ["-y", "mcp-remote@0.1.0", "https://mcp.posthog.com/mcp", "--header", "Authorization:${POSTHOG_AUTH_HEADER}"],
            "env": {"POSTHOG_AUTH_HEADER": "Bearer EXAMPLE-ONLY-NOT-A-KEY"}
          },
          "gateway-proxy": {
            "command": "npx",
            "args": [
              "-y",
              "mcp-remote@0.1.0",
              "https://gateway.example.com/mcp?k=exampleonly3333notarealkey33&sig=exampleonly4444notarealsig44",
              "--header",
              "X-Auth: exampleonly5555notarealkey55"
            ]
          },
          "quiet-controls": {
            "command": "npx",
            "args": [
              "-y",
              "example-mcp@1.0.0",
              "--auth",
              "oauth",
              "--project-id",
              "123e4567-e89b-42d3-a456-426614174000",
              "--credentials",
              "/home/example/.config/acme/adc.json"
            ]
          },
          "hidden-without-finding": {"command": "npx", "args": ["-y", "example-mcp@1.0.0", "-p", "exampleonlyword", "--dsn", "exampleonlydsn", "--auth", "exampleonlymode"]},
          "secret-short-k": {"command": "npx", "args": ["-y", "example-mcp@1.0.0", "-k", "exampleonlyk"]},
          "connection-positional": {"command": "npx", "args": ["-y", "example-postgres-mcp@1.0.0", "postgresql://analyst:exampleonly7777notreal77@example.com:5432/marketing"]},
          "connection-dsn-flag": {"command": "uvx", "args": ["example-warehouse-mcp==1.0.0", "--dsn", "postgresql://reader:exampleonly8888notreal88@example.com/mkt"]},
          "connection-env": {"command": "uvx", "args": ["example-warehouse-mcp==1.0.0"], "env": {"DATABASE_URL": "postgresql://reader:exampleonlyenv@example.com/mkt"}},
          "connection-jdbc": {"command": "npx", "args": ["-y", "example-mcp@1.0.0", "jdbc:sqlserver://example.com:1433;databaseName=mkt;user=reader;password=exampleonlyjdbc"]},
          "connection-keywords": {"command": "npx", "args": ["-y", "example-mcp@1.0.0", "host=example.com user=reader password=exampleonlylibpq"]},
          "token-in-package-url": {"command": "uvx", "args": ["--from", "git+https://oauth2:exampleonlygit@example.com/acme/tool.git@1a2b3c4", "tool"]},
          "secret-quoted-command": {"command": "bash", "args": ["-c", "export API_KEY=exampleonlyshell && npx -y example-mcp@1.0.0"]},
          "secret-json-argument": {"command": "npx", "args": ["-y", "example-mcp@1.0.0", "--config", "{\"apiKey\":\"exampleonlyjson\"}"]},
          "secret-auth-block": {"url": "https://mcp.example.com/mcp", "auth": {"CLIENT_ID": "example-client", "CLIENT_SECRET": "exampleonlyclient"}}
        }
      }
    },
    {
      "client": "cursor",
      "scope": "project",
      "path": "~/other-repo/.cursor/mcp.json",
      "project": "/home/example/other-repo",
      "format": "json",
      "content": {
        "mcpServers": {
          "credential-in-other-repo": {"command": "uvx", "args": ["example-mcp==1.0.0"], "env": {"GOOGLE_APPLICATION_CREDENTIALS": "/home/example/other-repo/secrets/adc.json"}}
        }
      }
    },
    {
      "client": "codex",
      "scope": "user",
      "path": "~/.codex/config.toml",
      "format": "toml",
      "content": "# Codex user config with a hand edit that lost its quotes (fictional)\n[mcp_servers.unquoted]\nenv = { API_TOKEN = exampleonly6666notreal66 }\n"
    },
    {
      "client": "vscode",
      "scope": "user settings",
      "path": "~/.config/Code/User/settings.json",
      "format": "json",
      "content": "{\n  // VS Code user settings, as some vendor guides write them\n  \"mcp\": {\"servers\": {\"klaviyo-settings\": {\"command\": \"uvx\", \"args\": [\"klaviyo-mcp-server@1.0.0\"], \"env\": {\"PRIVATE_API_KEY\": \"exampleonly9999notreal99\", \"READ_ONLY\": \"true\", \"ALLOW_USER_GENERATED_CONTENT\": \"false\"}}}},\n}\n"
    },
    {
      "client": "claude-code",
      "scope": "managed settings",
      "path": "/etc/claude-code/managed-settings.json",
      "format": "json",
      "content": {"managedMcpServers": {"records": {"type": "http", "url": "https://records.example.com/mcp", "headers": {"X-Records-Key": "exampleonlymanaged"}}}}
    },
    {
      "client": "claude-code",
      "scope": "project",
      "path": "~/acme-marketing/.mcp.json",
      "format": "json",
      "content": {
        "mcpServers": {
          "hubspot-legacy": {"command": "npx", "args": ["-y", "@hubspot/mcp-server@0.4.0"], "env": {"PRIVATE_APP_ACCESS_TOKEN": "${HUBSPOT_PRIVATE_APP_TOKEN}"}},
          "hubspot-developer": {"command": "npx", "args": ["-y", "@hubspot/cli", "mcp", "start"]},
          "hubspot-unlisted": {"command": "npx", "args": ["-y", "@hubspot/example-tool@1.0.0"]},
          "posthog-acme-prod-ro": {"type": "http", "url": "https://mcp.posthog.com/mcp?readonly=true&project_id=12345&mode=tools"},
          "google-ads-default": {"command": "pipx", "args": ["run", "--spec", "google-ads-mcp==0.0.6", "google-ads-mcp"]},
          "google-ads-tools-config": {"command": "pipx", "args": ["run", "--spec", "google-ads-mcp==0.0.6", "google-ads-mcp"], "env": {"GOOGLE_ADS_MCP_TOOLS_CONFIG": "/home/example/.config/google-ads-mcp/tools_config.yaml"}},
          "ga4-env-write": {"command": "pipx", "args": ["run", "--spec", "analytics-mcp==1.0.0", "analytics-mcp"], "env": {"ANALYTICS_MCP_ALLOW_WRITE": "true"}},
          "bridge-affected": {"command": "npx", "args": ["-y", "mcp-remote@0.1.14", "https://mcp.mixpanel.com/mcp"]},
          "bridge-current": {"command": "npx", "args": ["-y", "mcp-remote@0.16.1", "https://mcp.mixpanel.com/mcp"]},
          "env-file-in-repo": {"type": "stdio", "command": "npx", "args": ["-y", "example-mcp@1.0.0"], "envFile": "${workspaceFolder}/.env"},
          "sandboxed-server": {"type": "stdio", "command": "npx", "args": ["-y", "example-mcp@1.0.0"], "sandboxEnabled": true},
          "plain-websocket": {"type": "ws", "url": "ws://mcp.example.net/socket"}
        }
      }
    },
    {
      "client": "claude-code",
      "scope": "project settings",
      "path": "~/acme-marketing/.claude/settings.json",
      "format": "json",
      "content": {"enableAllProjectMcpServers": true, "enabledMcpjsonServers": ["hubspot-legacy"], "disabledMcpjsonServers": ["hubspot-developer"], "permissions": {"defaultMode": "auto", "allow": ["mcp__hubspot-acme-prod-ro__get_user_details", "mcp__hubspot-acme-prod-ro__*", "mcp__hubspot-acme-prod-ro__manage_crm_objects"]}}
    },
    {
      "client": "codex",
      "scope": "project",
      "path": "~/acme-marketing/.codex/config.toml",
      "format": "toml",
      "content": "# Codex project config: approval settings that skip a person (fictional)\n[mcp_servers.approve-everything]\nurl = \"https://mcp.example.com/mcp\"\ndefault_tools_approval_mode = \"approve\"\n\n[mcp_servers.approve-one]\nurl = \"https://mcp.example.com/other\"\n\n[mcp_servers.approve-one.tools.send_campaign]\napproval_mode = \"approve\"\n"
    }
  ]
}