You'll notice Notable
No documentation found
MCP and inference config now warn when headers look like they leak credentials over plain HTTP or shared tokens.
A new shared helper, credentialHeadersWarn, flags MCP server URLs/headers and inference custom headers that look like they leak plain-HTTP credentials or shared bearer tokens, with messages like "Endpoint is plain HTTP; auth credentials travel in cleartext" and "Shared bearer token: every org member authenticates as the same identity." It's applied to both managedMcpServers config and the inferenceCustomHeaders field.
Names in the bundlecredentialHeadersWarn
One source agreesOne thing we can check says the same as this entry.
Anthropic's release notes agree
Changed Claude apps gateway to also refuse to start, naming the field, when a desktop policy misspells a field in a nested object of a…