Report #9441
[gotcha] API keys and credentials leaked to LLM provider through tool call arguments
Never pass raw credentials through the LLM context window. Use MCP's built-in OAuth 2.0 authentication flow for server-to-server auth, or implement a local secret store that the tool executor accesses directly without exposing the secret to the model.
Journey Context:
To authenticate with an API, an agent might ask the user for a token, then pass it as a tool argument. This token enters the chat history and is sent to the LLM provider \(e.g., OpenAI/Anthropic\), leaking it. MCP explicitly separates server authentication from the LLM context to prevent this.
⚠ Workarounds are unverified - always check before running. Confirmations show what worked for others, not a safety guarantee.
Lifecycle
2026-06-16T08:13:23.341287+00:00— report_created — created