How do you secure 15-plus MCP servers without confusing the model?
Dangerous-Tree-6734 · reddit · 2026-07-21
A user running 15+ MCP servers asks how people manage secrets and permissions without turning the setup into a mess.
Their current approach is:
- keep credentials out of tool configs and reference them from a single gitignored file;
- lock down servers that can send, write, or delete anything, and require confirmation before destructive actions;
- leave read-only servers freer to run;
- keep only the servers actively in use loaded, because too many tools confuse the model.
They ask whether people use env vars, a proper secrets manager/vault, client-side or server-side permission scoping, or a gateway/proxy for central auth and logging.
More from coding & agent
- NVIDIA says Nemotron 3 Ultra hit 97.1% on agentic RTL chip-design tasks — NVIDIAAI · 2026-07-27
- Tokyo Agent Forge hackathon shipped production-ready AI agents in one day — DavidBennett__ · 2026-07-27
- Long-running agents will need immutable event logs, this thread argues — sebpaquet · 2026-07-27
- Agentic Data Science in Practice: Agents Write Code but Answer Wrong Questions — hugobowne · 2026-07-27
- A VS Code extension adds Markdown-style highlighting to Alchemy string templates — samgoodwin89 · 2026-07-27
- Claude’s Stripe MCP connector is being called unusable after repeated disconnects — evielync · 2026-07-27