MCP auth secrets are registered with a scrubbing utility so they can be redacted from logs and quoted response bodies.
Several MCP authentication code paths now call ku().record(...) to register sensitive values before they are used or attached to requests: the claude.ai proxy bearer token, the XAA jwt-bearer client secret/assertion, a basic-auth header, and WS auth tokens. Bearer tokens sent to claude.ai-backed servers are likewise recorded via ku().record(...) before being attached to the Authorization header, in both the claude.ai-proxy and generic OAuth request wrappers.
When constructing SSE/HTTP/WS MCP transports, custom headers are also passed through a new $le(headers, ...) call before the transport is built. $le scans header names/values against a secret-pattern regex (auth|token|key|secret|cookie|session|sig|pass|cred|bearer) and records matches via ku().record(...) unless recordingOff(), tracking credential-like strings seen in outgoing MCP requests, presumably for later redaction or leak detection.