01 / The operating case
What changes in a real workflow?
A local client launches an MCP server with a long-lived cloud key in environment variables; a tool result echoes the environment during debugging.
- 01Client / task
- 02MCP server
- 03Tool call + arguments
- 04Downstream effect
02 / Decision contract
What the executor must check
Use a narrowly scoped workload credential at the server, protect local configuration, rotate on exposure and prevent secrets from entering model context or logs.
03 / Failure and evidence
What goes wrong, and what can be proven?
Compromise of the client process or diagnostic output grants access beyond the current task.
Inventory credential owner, scope, lifetime, rotation event and any exposed output; redact secret values.
04 / Canonical scope
Why this reference stands alone
Token passthrough concerns audience misuse; this page owns credential custody and exposure.
Protocol or attack trace
Credential-exposure path
Local MCP server starts with cloud key K; debug tool echoes process environment into model-visible output.
Make a diagnostic call that requests environment variables; K must be excluded and rotated if exposed.
Primary references