Tool responses do not echo secrets or credentials

MCP tool responses are injected directly into AI context windows — any credential that appears in a response is now in the model's context and may be logged, cached, or included in future prompts. CWE-312 (cleartext storage of sensitive information) and CWE-532 (sensitive information in log files) are both active: a tool that echoes process.env in an error message or includes the Authorization header from a response object has leaked the credential to every downstream log, trace, and context export. OWASP A02 (Cryptographic Failures) and OWASP LLM02 (sensitive information disclosure) both apply.

Return only the response body from external API calls — never headers. Scrub credentials from error messages before returning them.

// src/tools/api.ts — strip credentials from output
server.tool('call_api', ..., async ({ endpoint }) => {
  try {
    const res = await fetch(endpoint, {
      headers: { Authorization: `Bearer ${process.env.API_KEY}` }
    })
    // Return body only — never return headers
    return { content: [{ type: 'text', text: await res.text() }] }
  } catch (error) {
    // Redact any credential patterns from error messages
    const safe = (error as Error).message
      .replace(/Bearer\s+\S+/gi, 'Bearer [REDACTED]')
      .replace(/[A-Za-z0-9_-]{20,}/g, '[REDACTED]')  // API key pattern
    return { content: [{ type: 'text', text: `Request failed: ${safe}` }], isError: true }
  }
})