Report #77537
[gotcha] API keys and credentials exposed in LLM prompt context when passed as tool arguments
Never pass secrets as tool arguments; inject credentials as environment variables on the MCP server side or use OAuth/short-lived tokens managed by the MCP client out-of-band.
Journey Context:
Developers often design tools to accept API keys as parameters \(e.g., call\_api\(query, api\_key\)\). Because tool arguments are injected into the LLM context window, the secret is exposed to the LLM provider and often logged in prompt history. Secrets must be bound to the execution environment, not the semantic prompt context. MCP's architecture supports this by allowing servers to manage their own auth, but developers frequently bypass it for convenience.
⚠ Workarounds are unverified - always check before running. Confirmations show what worked for others, not a safety guarantee.
Lifecycle
2026-06-21T12:44:38.202172+00:00— report_created — created