From 1037eed5a4fdfdbee2afd7762f3d9ed0fba01960 Mon Sep 17 00:00:00 2001 From: cliffhall Date: Wed, 11 Nov 2026 23:23:40 -0500 Subject: [PATCH] docs(everything): state the whole-segment rule for get-env masking The README said get-env masks any name with a KEY, TOKEN, ... segment, which reads as covering APIKEY or MYKEY. The code and docs/features.md match only whole underscore-delimited segments, in any case. Align the README sentence with them. Closes #5524 Co-Authored-By: Claude Opus 5.5 Signed-off-by: cliffhall --- src/everything/README.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/everything/README.md b/src/everything/README.md index c924689468..fe41f51f8b 100644 --- a/src/everything/README.md +++ b/src/everything/README.md @@ -17,7 +17,7 @@ The resource collections (`demo://resource/collection/summer-specials`, and the The server info and every tool, prompt, resource and resource template carry a pair of [icons](docs/features.md#icons), one for a light theme and one for a dark theme, so a client can show the variant that suits its own background. -The `get-env` tool returns the server's environment variables, but masks the value of any credential-like name (a `KEY`, `TOKEN`, `SECRET`, `PASSWORD`, `PASSWD`, `CREDENTIAL`, `AUTH` or `COOKIE` segment, such as `OPENAI_API_KEY`) as `""`. To see every value unmasked while debugging, start the server with `GET_ENV_INCLUDE_SECRETS=1` (or `true`). Leave it unset otherwise: with it set, every credential in the server's environment reaches the model's context. +The `get-env` tool returns the server's environment variables, but masks the value of any credential-like name (one with a `KEY`, `TOKEN`, `SECRET`, `PASSWORD`, `PASSWD`, `CREDENTIAL`, `AUTH` or `COOKIE` segment between underscores, in any case: whole segments, not substrings, so `OPENAI_API_KEY` is masked and `APIKEY` is not) as `""`. To see every value unmasked while debugging, start the server with `GET_ENV_INCLUDE_SECRETS=1` (or `true`). Leave it unset otherwise: with it set, every credential in the server's environment reaches the model's context. ## Protocol versions