Agents often need credentials to be useful. They also read files, execute tools, and ingest untrusted content. That combination makes plaintext API keys in .env files, shell profiles, and agent config a poor default. Pincer-MCP takes a proxy-token approach: the agent receives a limited token, while real API keys stay

MCP tools are not just code endpoints. Their names, descriptions, and schemas are fed to the model so it can decide what to call. That makes tool metadata part of the instruction channel. Tool shadowing and poisoned descriptions abuse that trust by hiding instructions where users rarely look but models

Most MCP security discussions focus on either secret leakage or prompt injection. In practice, you need both directions. Outbound tool arguments can carry secrets to an attacker-controlled server. Inbound tool responses can carry instructions that compromise the next model step. A useful MCP gateway scans both paths. The short version