everything: README description of get-env masking omits the whole-segment rule — APIKEY / MYKEY are not masked #5524

Which server?

everything (@modelcontextprotocol/server-everything)

Server version

2.3.0 — documentation and code read at v2/main commit 6cfff62

How did you run the server?

From a clone of this repository

Transport

Not applicable (a repository-level report)

Protocol era

Not applicable (a repository-level report)

MCP client and version

Not applicable (documentation report)

Operating system and runtime

No response

Server configuration

Not applicable — no server was run; this is a documentation report (reading only).

Steps to reproduce

Summary
The everything server's README says get-env masks the value of any name with a KEY, TOKEN, … segment, but the implementation — and docs/features.md — match only a whole underscore-delimited segment. Names such as APIKEY and MYKEY are therefore returned unmasked, contrary to a natural reading of the README sentence. The behavior is intentional and is stated correctly in features.md; only the README sentence is looser than both, so this asks for a wording fix in the README and nothing else.

The divergence
README (src/everything/README.md:20):

The get-env tool returns the server's environment variables, but masks the value of any credential-like name (a KEY, TOKEN, SECRET, PASSWORD, PASSWD, CREDENTIAL, AUTH or COOKIE segment, such as OPENAI_API_KEY) as "<redacted>".
"Segment" is left undefined here, and a natural reading of "a KEY … segment" includes a name that merely contains one of the words, e.g. APIKEY.

docs/features.md (src/everything/docs/features.md:34) states the rule precisely:

…the value of a credential-like name (one with a KEY, TOKEN, SECRET, PASSWORD, PASSWD, CREDENTIAL, AUTH or COOKIE segment between underscores, in any case) is replaced with "<redacted>".

Code (src/everything/tools/get-env.ts): isCredentialName (lines 80–84) uppercases the name, splits it on _, and masks only when one whole resulting segment is in the credential word set (lines 27–36). The file header states the intent directly (lines 10–11): "Whole segments, not substrings, so PWD, KEYBOARD or MONKEY stay readable."

Applying isCredentialName by hand gives:
| Name | Segments | Masked? |
| OPENAI_API_KEY | OPENAI / API / KEY | Yes (the README's own example) |
| key | KEY (case-insensitive) | Yes |
| SSH_AUTH_SOCK | SSH / AUTH / SOCK | Yes (over-masking, acknowledged in the code header) |
| APIKEY | APIKEY | No |
| MYKEY | MYKEY | No |
| MONKEY | MONKEY | No |
| KEYBOARD_LAYOUT | KEYBOARD / LAYOUT | No |
| TOKENIZER_PATH | TOKENIZER / PATH | No |

How verified (static reading only, at the pinned commit; no repository code was executed and no server was run):

1. Read the three sources: src/everything/README.md:20, src/everything/docs/features.md:34, src/everything/tools/get-env.ts (word set lines 27–36, header lines 10–14, isCredentialName lines 80–84).
2. Derived the table above by applying isCredentialName by hand to each name.
3. Cross-checked against the repository's own tests (src/everything/tests/tools.test.ts): the masked list includes OPENAI_API_KEY and key; the readable list is titled "no whole segment is a credential word" and includes PWD, KEYBOARD_LAYOUT, MONKEY and TOKENIZER_PATH. The tests pin the whole-segment semantics the README omits.

Expected behavior

Expected behavior (from the README sentence as written): the last five names in the table (APIKEY, MYKEY, MONKEY, KEYBOARD_LAYOUT, TOKENIZER_PATH) read as covered, i.e. their values should be masked as "".

Proposed wording (see also "Already prototyped a fix?" below): replace the parenthetical in the README.md:20 sentence with the features.md phrasing, plus the code header's own clarification. The sentence would read:

The get-env tool returns the server's environment variables, but masks the value of any credential-like name (one with a KEY, TOKEN, SECRET, PASSWORD, PASSWD, CREDENTIAL, AUTH or COOKIE segment between underscores, in any case — whole segments, not substrings, so OPENAI_API_KEY is masked and APIKEY is not) as "<redacted>".

Actual behavior

Actual behavior (code, and features.md): APIKEY, MYKEY, MONKEY, KEYBOARD_LAYOUT and TOKENIZER_PATH are returned unmasked, because no whole segment matches.

Checked and consistent everywhere, so no change is requested for them: PAT and GITHUB_PAT (the word PAT is in neither document's list nor the code's), and DATABASE_URL (neither segment is in the list). All three sources agree these names are outside the heuristic.

Why it matters
get-env is annotated read-only, and its masking exists because clients may auto-approve it (the code header, lines 5–7, cites #3986 and #5130). A user who names a variable APIKEY or MYKEY and relies on the README sentence can reasonably believe its value is redacted when it in fact reaches the model's context in full. Aligning the one sentence removes that false expectation; the heuristic itself, including its documented limits ("a safer default, not a guarantee", code header), is not in question.

Scope note
Documentation wording only: one sentence in src/everything/README.md. No change to masking behavior, the credential word set, or any other document is proposed. This is not a security report: the behavior is intentional, is documented correctly in features.md, and its limits are acknowledged in the code itself.

Logs or error output

Not applicable — static reading only; no server was run, so there are no logs or error output.

Already prototyped a fix?

No diff attached, and no fix was prototyped locally. Offered as text, per this repository's contribution model: replace the parenthetical in the README.md:20 sentence with the features.md phrasing, plus the code header's own clarification. The sentence would read:

The get-env tool returns the server's environment variables, but masks the value of any credential-like name (one with a KEY, TOKEN, SECRET, PASSWORD, PASSWD, CREDENTIAL, AUTH or COOKIE segment between underscores, in any case — whole segments, not substrings, so OPENAI_API_KEY is masked and APIKEY is not) as "<redacted>".

Before you submit

• I searched existing issues and this is not a duplicate.
• This is not a security vulnerability report (those go through the private advisory form).