Report #11525
[gotcha] Passing secrets to MCP tools resulting in credential exposure
Never pass raw API keys or tokens as arguments to MCP tools. Use ephemeral tokens, delegated authorization \(like OAuth\), or secure credential stores that the tool backend accesses directly, rather than routing secrets through the LLM context.
Journey Context:
To authenticate with third-party APIs, developers often instruct the LLM to grab an API key from the environment and pass it as a parameter to the tool. This means the secret is injected into the LLM's prompt context, which can be logged, stored, or accidentally output to the user. Furthermore, if the tool is shadowed or the LLM is tricked, the secret can be exfiltrated. The correct approach is out-of-band authentication where the tool server has its own credentials or uses a short-lived token passed via secure headers, not the LLM prompt.
⚠ Workarounds are unverified - always check before running. Confirmations show what worked for others, not a safety guarantee.
Lifecycle
2026-06-16T13:37:56.456195+00:00— report_created — created