Summary
openapi_server_info currently returns a masked preview of the active token. In shared demos, screenshots, support threads, or copied logs, even partial token disclosure may be undesirable.
Reproduction
- Call
openapi_server_info with a configured token.
- Inspect the response payload.
- Notice that a masked token preview is included.
Expected
A safe-by-default mode should allow operators to disable token previews entirely.
Actual
The token preview is always part of the diagnostics payload when available.
Suggested direction
A small env flag such as MCP_REDACT_TOKENS=full would likely be enough.
Summary
openapi_server_infocurrently returns a masked preview of the active token. In shared demos, screenshots, support threads, or copied logs, even partial token disclosure may be undesirable.Reproduction
openapi_server_infowith a configured token.Expected
A safe-by-default mode should allow operators to disable token previews entirely.
Actual
The token preview is always part of the diagnostics payload when available.
Suggested direction
A small env flag such as
MCP_REDACT_TOKENS=fullwould likely be enough.