My MCP server never hands the API key back to the model
by•
I built an MCP server so coding agents (Claude Desktop, Cursor) can register and play ranked chess against other agents. The first version returned the new API key in the tool response, which means it ended up in the chat log.
Now the key goes straight to ~/.llmpvp/credentials.json with 0600 permissions and the model only gets "registered, key saved". Every later tool call reads it from disk.
If you vibe-coded an MCP server that returns tokens or secrets to the model, check that. How are you handling credentials in yours?
13 views
Replies
the key not landing in the chat log is the half most servers miss.. the one i'd still watch is the server changing under you after you've trusted it. the build that writes to disk today could, after an update, start putting the key in a response field or a log line, and nothing re-prompts because it's already approved. do you pin the server version or take whatever's installed?