Developer data protection
Protect MCP keys and tokens
Review where an MCP credential is supplied, stored, inherited and exported, then remove unnecessary copies and confirm revocation with its issuer when access ends. A scrubbed configuration export or removed server entry does not describe every transcript, log or still-valid credential. Use synthetic values to review the lifecycle without exposing a real token.
For Developer platform and endpoint security
Keep the credential value out of the review record.
Inert, disabled synthetic configuration excerpts with a reserved invalid URL. No MCP connection or operational setting is created.01
Identify how the credential enters the connection
An MCP connection may use a supplied header, environment value, supported credential helper or OAuth flow. Record the method documented for the selected client and server, plus the owner and scope of the credential. Keep the actual value out of diagrams, tickets and review notes.
Current Codex configuration documentation distinguishes directly supplied environment values from named environment references and HTTP-header configuration. These mechanisms affect what appears in a configuration export. They are not interchangeable commands or a guarantee that a credential cannot reach another process or log.
Source context: OpenAI: Configuration reference
02
Map the copies made during normal use
Follow the credential from configuration into the connection process, then review tool results, exception messages, transcripts, diagnostic bundles and copied setup instructions. A connection working successfully establishes functionality, not the absence of sensitive copies.
The download pairs two inert Codex-style configuration excerpts: a disabled fictional server with an embedded fake Authorization value, and a disabled version using env_http_headers to name a fake environment reference. They use documented keys but must not be activated or imported into operational settings. The comparison shows useful configuration evidence without supplying a real credential.
| Stage | Possible copy | Review action |
|---|---|---|
| Configure | Literal value in a settings/export file | Prefer the supported reference mechanism where appropriate |
| Use | Environment or request header | Review scope and access without printing values |
| Troubleshoot | Error, transcript or diagnostic bundle | Inspect for unnecessary credential material |
| Retire | Config removed but credential may remain valid | Confirm issuer-side revocation or expiry |
03
Review an export before it becomes a support artifact
An exported configuration can contain credentials even when the usual UI hides them. Replace a secret value with a non-secret reference or explanatory placeholder while preserving the field names needed to understand the issue. Do not publish the raw export first and rely on later deletion.
Check the whole bundle, not only the configuration file. A credential may also have been echoed in a terminal error or copied into a transcript. The synthetic review sheet records each artifact separately and leaves the result unreviewed until somebody inspects it. The paired examples are not a general-purpose secret scanner.
04
Use current supported credential handling
Follow the documented configuration mechanism for the installed client rather than inventing a reference syntax. A named environment reference may reduce the secret stored in one file while still making the value available to the connection process. Confirm that this matches the server’s needs and the organisation’s access policy.
Claude Code documents connection-specific authentication and local credential handling. Its current MCP guide also describes deletion of stored OAuth tokens and client registration when a remote server is removed. Treat that as a documented local cleanup action, not proof that every issuer grant or exported copy has been revoked or deleted.
Source context: OpenAI: Configuration reference · Claude Code: MCP connections
05
Close access and retained-copy questions separately
When a connection is no longer needed, use the supported client removal process and have the credential owner review issuer-side revocation or expiry. Record the credential identifier or owner reference, never the value. Review any known exported files or support bundles through their own retention process.
If a credential was exposed, follow the organisation’s incident process rather than merely editing a transcript. Keep the evidence needed for investigation within its approved handling boundary. Recheck the connection after rotation or configuration changes using a safe functional procedure controlled by the responsible owner.
Put it into practice
MCP credential copy and export review
Compare synthetic exports and track configuration, runtime, support and retirement records.
Inert, disabled synthetic configuration excerpts with a reserved invalid URL. No MCP connection or operational setting is created.
Configuration
Record source, owner and scope
No value in the worksheet
Use and diagnostics
Review runtime, output and copied artifacts
Functionality is not secrecy evidence
Retirement
Local cleanup + issuer revocation + retained-copy review
Three distinct closeout facts
| Artifact | Credential handling question | State |
|---|---|---|
| Configuration | Literal value or supported reference? | Unreviewed |
| Runtime connection | Who can access the supplied value? | Unreviewed |
| Transcript/export | Was unnecessary credential material copied? | Unreviewed |
| Synthetic diagnostic pair | Fake value present before review and removed in counterpart | Illustrative only |
| Retirement | Local cleanup and issuer revocation recorded? | Unverified |
Work through your review
Use the checks to organise the evidence you need. Your selections stay in this tab.
0 of 3 reviewed
Example files for this task
Keep the source material and the instructions together. You can also download the complete worksheet or matrix as CSV.
README.mdInspect
# MCP credential lifecycle exercise
The two .example.toml excerpts use documented Codex keys with enabled=false and a reserved example.invalid URL. They are inert teaching files, not operational configuration. Do not activate or import them. The value is explicitly fake and no server or API call is made.
Compare embedded-value.example.toml and named-reference.example.toml, then use artifact-register.csv to review the actual artifact types in your approved process. Do not put real credentials into this pack. Removing a value from one example is not proof that all copies were found. Follow current client documentation for any real configuration or cleanup.
## Guide and sources
Canonical guide: https://aona.ai/resources/guides/mcp-credentials-config-transcripts/
Source review: 2026-09-21
- OpenAI: Configuration reference: https://learn.chatgpt.com/docs/config-file/config-reference
- Claude Code: MCP connections: https://code.claude.com/docs/en/mcp
The paired diagnostic-before.txt and diagnostic-reviewed.txt files show a fake value leaking into a troubleshooting excerpt and the minimum reviewed counterpart. They are authored examples, not logs from a tool or output from an automatic scrubber. Keep the useful status and connection label while removing the unnecessary value, and review other copies separately.
embedded-value.example.tomlInspect
# INERT SYNTHETIC EXCERPT. Do not activate or import into operational settings.
# The server is disabled and the URL is reserved/invalid.
[mcp_servers.synthetic_d17]
enabled = false
url = "https://example.invalid/mcp"
[mcp_servers.synthetic_d17.http_headers]
Authorization = "Bearer NOT_A_TOKEN_D17_EXAMPLE"
named-reference.example.tomlInspect
# INERT SYNTHETIC EXCERPT. Do not activate or import into operational settings.
# This names an environment reference only; no value is supplied.
[mcp_servers.synthetic_d17]
enabled = false
url = "https://example.invalid/mcp"
[mcp_servers.synthetic_d17.env_http_headers]
Authorization = "AONA_D17_FAKE_AUTH_HEADER"
artifact-register.csvInspect
artifact,credential_source_or_reference,no_secret_value_recorded,review_result,retention_or_cleanup_owner,evidence
Configuration export,RECORD LABEL ONLY,VERIFY,UNREVIEWED,ASSIGN,
Runtime diagnostic,RECORD LABEL ONLY,VERIFY,UNREVIEWED,ASSIGN,
Conversation transcript,RECORD LABEL ONLY,VERIFY,UNREVIEWED,ASSIGN,
Support bundle,RECORD LABEL ONLY,VERIFY,UNREVIEWED,ASSIGN,
Issuer credential grant,RECORD IDENTIFIER ONLY,VERIFY,UNVERIFIED,ASSIGN,
retirement-note.mdInspect
# MCP access closeout
Connection label: ____________________
Credential owner/reference, not value: ____________________
Supported local removal action: ____________________
Issuer-side revocation or expiry evidence: ____________________
Known export/transcript copies and handling: ____________________
Remaining access or retained-copy question: ____________________
Decision: NOT YET REVIEWED
No action is performed by this file. An exposure should follow the organisation’s incident process.
diagnostic-before.txtInspect
SYNTHETIC D17 DIAGNOSTIC EXAMPLE, NOT A REAL CLIENT LOG
Connection label: SYNTHETIC_D17_SERVER
Example outcome: HTTP403
Authorization: Bearer NOT_A_TOKEN_D17_EXAMPLE
Source reference: embedded-value.example.toml
No request was made.
diagnostic-reviewed.txtInspect
SYNTHETIC D17 REVIEWED DIAGNOSTIC, NOT A REAL CLIENT LOG
Connection label: SYNTHETIC_D17_SERVER
Example outcome: HTTP403
Authorization: [CREDENTIAL_VALUE_REMOVED]
Source reference: embedded-value.example.toml
No request was made. Other artifacts still require review.
Before you proceed
Keep these distinctions clear
- Exporting a hidden UI value
- A UI hiding a token does not establish that a settings or diagnostic export omits it.
- Equating local removal with issuer revocation
- Record both actions and any retained diagnostic copies through their responsible owners.
Apply it to employee AI use
Bring your actual data path.
Aona’s limited-rollout native agent inspection can support a scoped review of known agent and MCP context.
This is not an Aona credential vault, automatic export scrubber or remote-token revocation capability. Confirm the supported runtime and privacy scope.
Bring the non-secret lifecycle record to a scoped native-agent inspection discussion; keep credential values with their authorised owner.
Review your use caseFAQ
Questions for this decision
Does an environment reference mean a credential can never leak?
Should we activate either downloaded configuration excerpt?
Does removing an MCP server revoke every token?
Should a support ticket contain the credential to reproduce a problem?
Evidence behind the guide
Sources and scope
Prepared by Aona. Sources checked 2026-09-21. The cited material supports the specific points below; it does not certify a product or your use case.
- OpenAI: Configuration reference
Documents MCP environment values, references and HTTP credential/header options.
vendor · checked 2026-09-21 - Claude Code: MCP connections
Documents authentication and connection-specific local credential cleanup.
vendor · checked 2026-09-21