Several MCP authentication code paths now call ku().record(...) to register sensitive values before they are used or attached to requests: the claude.ai proxy bearer token, the XAA jwt-bearer client secret/assertion, a basic-auth header, and WS auth tokens. Bearer tokens sent to claude.ai-backed servers are likewise recorded via ku().record(...) before being attached to the Authorization header, in both the claude.ai-proxy and generic OAuth request wrappers.
When constructing SSE/HTTP/WS MCP transports, custom headers are also passed through a new $le(headers, ...) call before the transport is built. $le scans header names/values against a secret-pattern regex (auth|token|key|secret|cookie|session|sig|pass|cred|bearer) and records matches via ku().record(...) unless recordingOff(), tracking credential-like strings seen in outgoing MCP requests, presumably for later redaction or leak detection.