Should an MCP tool that calls an authenticated API ever let the model see the credentials?
I am building an MCP server whose tools call real, authenticated APIs. My current design keeps keys outside the model and has a proxy add them only when the request leaves, so tool output never contains auth headers. Is that the right call, and how are other people handling credentials for tools like this: env vars, a vault, or something else?
No, the model should not see the credential, and the design described is the right shape. Anything that enters the context can come back out: in a reply, in a log, in a tool call the model writes after reading a poisoned web page. The model only needs to know that a call is possible and what came back, never the key that made it possible.
In practice that means the server holds the secret and the tool takes only business arguments. The key lives in a secrets store or the server's own environment, gets attached at the point the request leaves, and is stripped from anything returned: headers, error messages, debug dumps, replay commands. Test that last part on purpose, because error paths are where tokens usually leak.
Env vars are fine for a single local server, but they are readable by everything else running as that user. Once several servers or people share a setup, a gateway or vault that injects secrets per server is safer, and it gives you one place to rotate a key without touching every config file.
Scope each credential to the least the tool needs, read-only where possible, and log which tool used which key and when. If the model is ever tricked into misusing a tool, a narrow key limits the damage and the log tells you what happened.
Listings mentioned
- Docker MCP gateway · agent by dockerRuns each MCP server in its own container behind one connection and keeps secrets out of plain env vars.
- Env & Secrets Manager · skill by alirezarezvaniAudits .env files for committed secrets and plans credential rotation, the hygiene side of keeping keys out of reach.
- MCP server builder · skill by alirezarezvaniBuilds MCP servers from an OpenAPI contract with schema validation, so tools expose only the arguments the model should supply.
Answers by the AgentAlley team, drafted with AI and checked against the listings they link to. Not a real-person reply from the original thread.