​
Sharing MCP Servers in Plugged.in

This document explains how MCP server sharing works in Plugged.in, focusing on security practices and how sensitive information is handled.

​
Security Overview

When you share an MCP server in Plugged.in, we prioritize security by ensuring that sensitive information like credentials, API keys, and private URLs are never exposed to other users.

​
What Information is Shared?

When you share a server, the following information is shared:

Shared Information

  • Server title and description
  • Server type (STDIO, SSE, or Streamable HTTP)
  • Basic command and arguments structure
  • URL structure (with credentials removed)

Protected Information

  • Passwords and API keys in database URLs
  • Environment variables containing secrets
  • Authentication tokens
  • Private API keys
  • Any other credentials

​
How Sanitization Works

When you share an MCP server, Plugged.in automatically performs these security measures:
1

Template Creation

We create a sanitized template of your server configuration
2

Credential Removal

Any passwords in connection strings are replaced with placeholders
3

Environment Variable Protection

Sensitive environment variables are replaced with descriptive placeholders
4

API Key Protection

API keys in URLs or parameters are removed

​
Example of Sanitization

postgresql://postgres:MySecretPassword123!@database.example.com:5432/my_database

​
When Importing Shared Servers

When someone imports a server you’ve shared:
  1. They receive the sanitized template with placeholders
  2. They must provide their own credentials to make the server work
  3. The template serves as a guide for proper configuration
  4. A note indicates that the server was imported from a shared template
Imported servers are marked with a special indicator showing they came from a shared template, helping users understand they need to configure their own credentials.

​
Best Practices

Even with these protections in place, it’s good practice to:

​
Sharing Process

​
Making a Server Public

  1. Navigate to your MCP Servers page
  2. Click on the server you want to share
  3. Toggle the “Share” option
  4. Review the sanitized configuration
  5. Add a description for other users
  6. Confirm sharing

​
Discovering Shared Servers

Users can discover shared servers through:
  • Search Page: Browse all publicly shared servers at /search
  • Search: Find servers by name or description
  • Trending: View popular servers based on usage
  • User Profiles: See servers shared by specific users

​
Privacy Considerations

Your privacy is protected:
  • Original configuration data never leaves your account
  • Sanitization happens server-side before sharing
  • You can unshare a server at any time
  • Usage statistics are anonymous

​
Troubleshooting

​
Common Issues

If an imported server isn’t working:
  • Verify you’ve replaced all placeholder values
  • Check environment variable names match
  • Ensure API keys are correctly formatted
  • Test connection strings separately

​
Questions or Concerns

If you have any questions or concerns about server sharing security, please contact us at support@plugged.in.