[Blog](https://cohesivity.ai/blog) MCP Published Jul 11, 2026·Updated Aug 30, 2026 ![](https://cohesivity.ai/authors/shouryamaan.webp)![](https://cohesivity.ai/authors/arag.webp)[Shouryamaan](https://www.linkedin.com/in/shouryamaanjain/) and [Arag](https://www.linkedin.com/in/aragagrawal/) # MCP Security: How to Keep API Keys Away From AI Agents [Read as Markdown](https://cohesivity.ai/blog/mcp-security-api-keys.md) Credential Provider key Scoped Redacted Provider keys should stay outside model context, tool arguments, tool results, URLs, browser code, and logs. The MCP server uses a separate upstream credential, while the model receives only the authorized tool result. An MCP access token also needs protection, but it is not the provider token. Passing it through to the upstream API breaks the audience boundary defined by the protocol. ## Where credentials leak ### Prompt and context An agent reads `.env` to diagnose configuration, then echoes the value into its reasoning, generated code, or transcript. Prevent the model-facing file tools from reading secret stores where possible. When a process needs a credential, inject it directly into that process rather than asking the model to retrieve it. ### Tool arguments and results A tool accepts `apiKey` because it mirrors the upstream API, or returns a provider response containing credentials and debug headers. Remove secret fields from the schema entirely. The server should resolve credentials from authenticated session state. ### URLs Query strings appear in access logs, browser history, analytics, error reports, and screenshots. The [MCP authorization specification](https://modelcontextprotocol.io/specification/2025-06-18/basic/authorization) requires bearer access tokens in the `Authorization` header and forbids them in the URI query string. ### Logs and traces HTTP middleware may record headers and bodies before application redaction runs. Error trackers may capture environment variables, subprocess commands, or local files. Redact at the collection boundary and test the serialized event, not merely the logger call. ### Generated code and artifacts An agent may hard-code a value into a script, fixture, notebook, screenshot, or build output even when `.env` is ignored by Git. Scan the built client bundle and generated artifacts for credential prefixes before deployment. The [AI agent security guide](https://cohesivity.ai/blog/ai-agent-security-identity-permissions-secrets-audit-logs) covers secret handling beyond MCP. ## Use two authorization boundaries ```mermaid flowchart LR C[MCP client] -->|MCP access token| S[MCP server] S -->|validated user and policy| P[Tool executor] P -->|separate upstream credential| U[Provider API] U -->|bounded result| P P -->|redacted tool result| C ``` The MCP server validates that the access token was issued for its audience. It then authorizes the represented user and tool action. The executor uses a credential intended for the upstream service. The upstream API authorizes the final resource where possible. The MCP specification explicitly forbids forwarding the inbound MCP token to the upstream API. The [authentication and authorization guide](https://cohesivity.ai/blog/mcp-authentication-and-authorization-guide) explains resource indicators, audience checks, and separate downstream authorization. ## Scope the upstream credential to the tool Use a credential that can perform only the actions and resources the tool needs. A read-only customer lookup should not run under an account administrator key. If the provider cannot issue an adequate scope, place a narrow server-side proxy in front of it and enforce the missing rule there. Use separate credentials for development and production. Keep production credentials out of coding-agent workspaces and test fixtures. ## Keep Cohesivity credentials server-side Cohesivity separates a management key used for tenant administration from an application key used for provisioned services. Both stay in server-side code. Upstream provider credentials remain inside Cohesivity. For an HTTP application, exchange the application key for a short-lived edge session token where the offering supports it, then keep that token in the server request path. Do not place a `coh_*` value into a public environment variable or browser request. The [backend provisioning walkthrough](https://cohesivity.ai/blog/how-ai-coding-agents-provision-databases-auth-storage-hosting) shows this split during a full setup. ## Test redaction with a canary Use a fake credential-shaped canary in a test environment. Run the request through model input, tool execution, upstream failure, retry, logging, tracing, and error reporting. Then search every captured artifact for the canary. Test at least: - request and response logs; - trace attributes and events; - error tracker payloads; - model transcripts; - generated source and build output; - shell history and process command lines; - test snapshots and fixtures. Do not use a live credential for this test. ## Design rotation and revocation before the incident Record the credential's owner, scope, creation time, last use, rotation process, and revocation path. Rotation should allow the old and new credentials to overlap only as long as deployment requires. Revocation should not require deleting the human user's account or every integration in the organization. The prompt below follows one named credential through the whole system without printing its value. or send it to[Claude Code](https://claude.ai/new?q=Audit+one+provider+credential+used+by+this+project%27s+MCP+server.+Do+not+print+secret+values+or+make+external+calls.+Trace+how+the+credential+is+created%2C+stored%2C+injected%2C+read%2C+used%2C+rotated%2C+revoked%2C+and+redacted+across+prompts%2C+model+context%2C+tool+schemas%2C+arguments%2C+results%2C+URLs%2C+browser+bundles%2C+subprocess+environments%2C+logs%2C+traces%2C+errors%2C+tests%2C+screenshots%2C+and+generated+artifacts.+Cite+exact+files+and+configuration+names+without+revealing+values.+Flag+token+passthrough+and+credentials+with+broader+scope+than+the+tool.+Return+a+containment+plan+and+one+automated+test+for+every+leak+path. "Send to Claude")[Cursor](https://cursor.com/link/prompt?text=Audit+one+provider+credential+used+by+this+project%27s+MCP+server.+Do+not+print+secret+values+or+make+external+calls.+Trace+how+the+credential+is+created%2C+stored%2C+injected%2C+read%2C+used%2C+rotated%2C+revoked%2C+and+redacted+across+prompts%2C+model+context%2C+tool+schemas%2C+arguments%2C+results%2C+URLs%2C+browser+bundles%2C+subprocess+environments%2C+logs%2C+traces%2C+errors%2C+tests%2C+screenshots%2C+and+generated+artifacts.+Cite+exact+files+and+configuration+names+without+revealing+values.+Flag+token+passthrough+and+credentials+with+broader+scope+than+the+tool.+Return+a+containment+plan+and+one+automated+test+for+every+leak+path. "Send to Cursor")[Codex](https://chatgpt.com/codex?prompt=Audit+one+provider+credential+used+by+this+project%27s+MCP+server.+Do+not+print+secret+values+or+make+external+calls.+Trace+how+the+credential+is+created%2C+stored%2C+injected%2C+read%2C+used%2C+rotated%2C+revoked%2C+and+redacted+across+prompts%2C+model+context%2C+tool+schemas%2C+arguments%2C+results%2C+URLs%2C+browser+bundles%2C+subprocess+environments%2C+logs%2C+traces%2C+errors%2C+tests%2C+screenshots%2C+and+generated+artifacts.+Cite+exact+files+and+configuration+names+without+revealing+values.+Flag+token+passthrough+and+credentials+with+broader+scope+than+the+tool.+Return+a+containment+plan+and+one+automated+test+for+every+leak+path. "Send to Codex")[opencode](https://opencode.ai/?q=Audit+one+provider+credential+used+by+this+project%27s+MCP+server.+Do+not+print+secret+values+or+make+external+calls.+Trace+how+the+credential+is+created%2C+stored%2C+injected%2C+read%2C+used%2C+rotated%2C+revoked%2C+and+redacted+across+prompts%2C+model+context%2C+tool+schemas%2C+arguments%2C+results%2C+URLs%2C+browser+bundles%2C+subprocess+environments%2C+logs%2C+traces%2C+errors%2C+tests%2C+screenshots%2C+and+generated+artifacts.+Cite+exact+files+and+configuration+names+without+revealing+values.+Flag+token+passthrough+and+credentials+with+broader+scope+than+the+tool.+Return+a+containment+plan+and+one+automated+test+for+every+leak+path. "Send to OpenCode")