[cliffhall]

Closes #5524

Description

The everything README said get-env masks the value of any name with "a KEY, TOKEN, … segment". Read naturally, that covers APIKEY or MYKEY, but the code (isCredentialName in tools/get-env.ts) and docs/features.md match only a whole underscore-delimited segment, in any case. This PR rewrites that one parenthetical to use the features.md wording, plus the code header's clarification:

(one with a KEY, TOKEN, SECRET, PASSWORD, PASSWD, CREDENTIAL, AUTH or COOKIE segment between underscores, in any case: whole segments, not substrings, so OPENAI_API_KEY is masked and APIKEY is not)

Masking behavior and the credential word set are unchanged.

Server Details

• Server: everything
• Changes to: README.md only (the get-env masking sentence)

Motivation and Context

See #5524. get-env is annotated read-only, so clients may auto-approve it. A user who named a variable APIKEY and trusted the README would expect its value to be redacted, but the full value would reach the model's context.

How Has This Been Tested?

This change has nothing a client can observe, so the evidence is a targeted check that the new sentence matches what the code does:

• isCredentialName uppercases the name, splits it on _, and masks only when a whole segment is in the credential word set. So OPENAI_API_KEY is masked and APIKEY is not, exactly as the sentence now says.
• The existing tests in src/everything/__tests__/tools.test.ts already pin these semantics: OPENAI_API_KEY and key are masked, while KEYBOARD_LAYOUT, MONKEY and TOKENIZER_PATH stay readable.
• npm run local:gate exits 0.

Breaking Changes

None.

Types of changes

• Bug fix (non-breaking change which fixes an issue)
• New feature (non-breaking change which adds functionality)
• Breaking change (fix or feature that would cause existing functionality to change)
• Documentation update

Checklist

• I have read the MCP Protocol Documentation
• My changes follow MCP security best practices
• I have updated the server's README accordingly
• I have added a changeset (not applicable: documentation only; what the server does is unchanged)
• I have tested this with an LLM client (not applicable: no server-facing change)
• My code follows the repository's style guidelines
• New and existing tests pass locally
• I have added appropriate error handling (not applicable: no code change)
• I have documented all environment variables and configuration options (not applicable: none added or changed)

🤖 Generated with Claude Code

[changeset-bot]

⚠️ No Changeset found

Latest commit: 1037eed

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

This PR includes no changesets

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

[github-actions]

everything: MCP interface diff

Base: bdfb2e314df7 (Merge pull request #5529 from modelcontextprotocol/v2/chore/5506-alerts-hoisted-copy-scope)
Head: the build in this checkout, at 884fc06b5bdf (Merge 1037eed into bdfb2e3)

Diffed because it was named (--server).

✅ No interface changes detected.

	Tools	Prompts	Resources	Resource templates
Base	22	4	8	5
Head	22	4	8	5

_{Updated by this run for 1037eed5a4fdfdbee2afd7762f3d9ed0fba01960.}

[Copilot]

🟢 Approval recommended

No active review issues were identified for the documentation clarification of credential-name masking.

No open issues 🎉

What changed in this PR

Clarifies the everything server’s get-env documentation to address #5524 without changing masking behavior.

Changes:

• Specifies that credential words match whole underscore-delimited segments, case-insensitively, rather than substrings.
• Contrasts masked OPENAI_API_KEY with unmasked APIKEY.

File	Description
src/​everything/​README.md	Clarifies the existing credential-name masking rule and adds contrasting examples.

_{Review effort: Balanced}

[cliffhall]

Copilot round 1: clean (no findings, no suppressed comments). The loop stops on the first clean round. CI is green.