{"version":"2.1.260","anchor":"mcp-web-search-built-in-server-pushes-api-keys-out-of-heade","canonical_anchor":"mcp-web-search-built-in-server-pushes-api-keys-out-of-heade","heading":"MCP websearch built-in server steers API keys out of headers","tier":"notice","area":"MCP","scope":null,"heads_up":null,"url":"https:\/\/changelogs.core-directive.com\/v\/2.1.260\/e\/mcp-web-search-built-in-server-pushes-api-keys-out-of-heade","release_url":"https:\/\/changelogs.core-directive.com\/v\/2.1.260","markdown":"### MCP websearch built-in server steers API keys out of `headers`\n\nWeb-search MCP server config now steers you away from putting API keys directly in headers.\n\nThe built-in websearch MCP server's config schema now more strongly steers users toward a headers-helper script instead of storing provider API keys directly in the `headers` field, with new copy framing the API key as a credential that should not be stored inline.\n\nThe `headers` subfield's redaction annotation changed its redact mode from `drop` to `presence`, so config\/telemetry snapshots now record only that headers were set rather than fully dropping the field.\n\n- Area: MCP\n- Tier: You'll notice\n- Useful: 1\/5\n- Signal: 1\/5"}