Report #74579
[gotcha] MCP server logs or returns sensitive credentials from previous tool calls
Implement token vaulting or ephemeral credential passing. Never return raw tokens to the agent's context window; use opaque handles or inject credentials directly at the execution layer, bypassing the LLM.
Journey Context:
MCP servers often need to authenticate to APIs. If the LLM passes the token, or the server returns it, it stays in the context window, potentially being logged, exfiltrated via another tool, or sent to a third-party LLM provider. The fix is to inject credentials at the tool execution boundary \(like a sidecar or middleware\) so the LLM never sees them, preventing accidental disclosure or malicious extraction.
⚠ Workarounds are unverified - always check before running. Confirmations show what worked for others, not a safety guarantee.
Lifecycle
2026-06-21T07:46:53.500154+00:00— report_created — created