Secrets

Secret paths are denied by default. The check is the base name, case-insensitive.

Match	Examples
.env or .env.*	.env, .env.local
exact name	credentials.json, .npmrc, .pypirc
prefix	id_rsa*, id_ed25519*, id_ecdsa*
extension	.pem, .key, .p12, .pfx

A denied call returns SECRET_DENIED. retryable is false. The suggestion is to pass --allow-secrets to read. Writes are still audited.

--allow-secrets is off by default. When it is on, a read of a secret path is audited (allow-secrets on the log entry).

This denylist is not the file security policy. A policy can also hide .env or **/secrets/**. Both can apply. The denylist does not require --file-security-config.

Do not put secrets in the MCP client JSON. The server does not read an API key.