{"version":"2.1.260","anchor":"new-credential-header-safety-warning-for-mcp-config-and-infe","canonical_anchor":"new-credential-header-safety-warning-for-mcp-config-and-infe","heading":"New credential-header safety warning for MCP config and inference headers","tier":"notice","area":"Permissions","scope":null,"heads_up":null,"url":"https:\/\/changelogs.core-directive.com\/v\/2.1.260\/e\/new-credential-header-safety-warning-for-mcp-config-and-infe","release_url":"https:\/\/changelogs.core-directive.com\/v\/2.1.260","markdown":"### New credential-header safety warning for MCP config and inference headers\n\nMCP and inference config now warn when headers look like they leak credentials over plain HTTP or shared tokens.\n\nA new shared helper, `credentialHeadersWarn`, flags MCP server URLs\/headers and inference custom headers that look like they leak plain-HTTP credentials or shared bearer tokens, with messages like \"Endpoint is plain HTTP; auth credentials travel in cleartext\" and \"Shared bearer token: every org member authenticates as the same identity.\" It's applied to both `managedMcpServers` config and the `inferenceCustomHeaders` field.\n\n- Area: Permissions\n- Names: `credentialHeadersWarn`\n- Tier: You'll notice\n- Useful: 2\/5\n- Signal: 1\/5"}