Usually, no. An MCP tool should return the result needed for the task—not the API key, access token, or other credential used to produce it. Once a secret enters a tool result, it can flow into the client and model context, and potentially into conversation history, logs, memory, generated code, error reports, or later tool calls. Where it goes depends on the application, but the safer default is to keep credentials inside the trusted execution and authentication boundary.
What it means when a tool returns a secret
A tool result is data sent from the server back to the MCP client. If that result contains a credential, the value is no longer confined to the component that needed it to authenticate an upstream request. It may become visible to the model or be copied into other application pathways. The exact retention and logging behavior varies by client and deployment; do not assume that a returned value stays only in the immediate tool response. The OWASP MCP Security Cheat Sheet advises validating and sanitizing tool outputs before they enter LLM context.
As an Amazon Associate I earn from qualifying purchases.
That does not mean every secret in every tool result proves a protocol vulnerability. The relevant questions are whether the tool is authorized to disclose that value to this client and model, whether the caller needs it, and where the result can flow. MCP’s Security Policy and Trust Model treats connected servers and local software as trusted within a deployment’s assumptions; a server doing its documented job with configured permissions is not, by that fact alone, a protocol flaw. Unauthorized access, token leakage, or crossing an established trust boundary is different.
Quick wins for a faster PC:
Scan for outdated or missing drivers - takes under a minuteDriver Scan →Repair Windows errors before they cause bigger problemsFix Now →Should an MCP tool return an API key?
Only if revealing the key itself is explicitly required and authorized—which is rarely necessary for an ordinary task. If the user asks to create a report, send a message, or retrieve account data, the model generally needs the operation result, not the credential that enabled it.
#1 Best Overall
- POWERFUL SECURITY KEY: The Security Key C NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key C NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key C NFC via USB-C and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
MCP’s security policy warns that a language model may invoke tools in ways the user did not explicitly request and may call multiple tools in sequence. Tool selection is therefore not a reliable security boundary. Server and application code must enforce access control, document permissions, validate inputs for sensitive operations, and follow least privilege. Client developers should make capabilities understandable, seek consent where appropriate, show tool activity where appropriate, and sandbox server execution where feasible. These responsibilities are described in the MCP Security Policy and Trust Model.
How credentials should flow instead
- Keep the credential in a trusted location. Store it in a secret manager or server-side configuration that is not included in tool results.
- Have the model request an operation, not handle the secret. The model supplies ordinary task parameters; trusted server-side code attaches the credential when making the upstream request.
- Authorize the action on the server. Check the principal and the specific operation before execution. For HTTP authorization, validate that a token is intended for the MCP server receiving it. The MCP Authorization Security Considerations state: “The MCP server MUST NOT pass through the token it received from the MCP client.” Use a separately issued upstream credential rather than forwarding the MCP client’s access token.
- Return only task-relevant fields. Filter success responses and exceptions so they contain useful results without secrets or unnecessary personal data.
- Protect every output path. Redact credentials and personal information from logs, traces, analytics, and error payloads. Validate and sanitize outputs before they return to model context, since one tool’s output may become another tool’s input.
- Confirm consequential actions. When the application requires human approval for sensitive sharing or destructive work, show the actual parameters to be approved—not an opaque action summary.
Short-lived, narrowly scoped credentials can reduce the impact of a leak, but do not make it safe to return a token. Least privilege and limited lifetime are damage controls, not substitutes for keeping a credential out of an unauthorized context. See the MCP Authorization Security Considerations and OWASP’s MCP guidance.
Rank #2
- POWERFUL SECURITY KEY: The YubiKey 5C NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5C NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5C NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
Why did the tool expose a token?
Common design failures include returning the upstream response without filtering it, serializing a configuration object that contains credentials, or placing an exception message with request headers into the result. Logging and telemetry can create the same exposure even if the user-facing result looks clean. The fix is to inspect and sanitize success and failure paths, as well as logs, traces, and analytics—not just the happy-path response.
The Tool Desk
Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Also treat tool content as untrusted data, not instructions. A result may contain content that attempts to direct the model to reveal information or call another tool. Delimiting returned data and telling a model not to obey instructions found inside it may help, but cannot replace application-side authorization and access controls. Google Cloud discusses this risk in its AI security and safety guidance for Google Cloud MCP servers.
Rank #3
- POWERFUL SECURITY KEY: The YubiKey 5 NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5 NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5 NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
How to stop secrets from appearing in agent logs
- Use structured, allowlisted log fields rather than logging full request and response objects.
- Redact credentials and personal data before events reach log, trace, or analytics sinks; avoid relying on cleanup after collection.
- Keep error reporting from capturing authorization headers, environment variables, secret-bearing configuration, or raw upstream payloads.
- Test both successful and failed tool calls for accidental disclosure, including chained calls where one result becomes another tool’s input.
- Restrict access to retained logs and telemetry, and define retention and deletion practices for the application.
These are implementation safeguards, not a guarantee that every client stores data in the same way. Check the behavior of the specific MCP client and deployment, and minimize sensitive data before it reaches them.
What to do if a credential was actually exposed
- Contain the credential. Revoke or rotate it if it reached model context, logs, telemetry, generated code, or another location outside its intended boundary. A short lifetime does not undo disclosure.
- Limit further access. Review the credential’s permissions and revoke sessions or dependent credentials where appropriate.
- Find the path. Check tool results, exception handling, conversation retention, logs, traces, analytics, and downstream tool inputs to determine where the value went.
- Fix and test the boundary. Remove the credential from outputs, add redaction and output validation, and test the affected success and error paths before restoring the integration.
Does using a vault solve the problem?
A vault or secret manager can keep credentials out of model-visible results when trusted code retrieves and attaches them to an upstream request. It does not, by itself, ensure that the right operation is authorized, that a credential has appropriate scope, or that outputs and logs are clean.
Rank #4
- POWERFUL SECURITY KEY: The Security Key NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key NFC via USB-A and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
A 2026 preprint by Kenney, Ahmadi, Lusson, Nguyen, and Gill reports a controlled functional evaluation using 16 probes across seven control domains. The authors characterize the study as purposive and small, and explicitly say it is not a certification. It is evidence about a limited evaluation, not proof that vault-mediated designs are secure in every deployment: the preprint.
Recommended Free Tools
Quick Recap
Best Value
- POWERFUL SECURITY KEY: The YubiKey 5 is a versatile physical passkey that protects your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5 secures 100+ of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5 via USB and tap it to authenticate. No batteries, no internet connection, and no extra fees required.
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
