Merge pull request #191 from googio/docs/mcp-json-secret-scope

docs(mcp-bridge): scope the commit-safety note to the serply entry

1 file · +6 -3

M examples/extensions/mcp-bridge/README.md +6 -3


@@ -287,9 +287,12 @@ is the first one that writes a `headers` entry:
287	287		}
288	288		```
289	289
290		-	The template writes the variable reference, not the key, so `mcp.json` holds no
291		-	secret and stays safe to commit or sync. The bridge expands it from its own
292		-	environment at load time (see [Environment variables](#environment-variables));
	290	+	The template writes the variable reference, not the key, so this entry holds no
	291	+	secret. The file around it is a separate question: another server can hold a
	292	+	literal credential, the way the You.com example above writes one inline, so
	293	+	treat `mcp.json` as safe to commit or sync only when every entry in it uses a
	294	+	variable reference. The bridge expands the reference from its own environment
	295	+	at load time (see [Environment variables](#environment-variables));
293	296		with `SERPLY_API_KEY` unset, this server is disabled and reported by name while
294	297		every other server keeps working. Get a key at
295	298		[serply.io](https://serply.io); the API reference is at

 }
 ```
-The template writes the variable reference, not the key, so `mcp.json` holds no
+The template writes the variable reference, not the key, so this entry holds no
-secret and stays safe to commit or sync. The bridge expands it from its own
+secret. The file around it is a separate question: another server can hold a
-environment at load time (see [Environment variables](#environment-variables));
+literal credential, the way the You.com example above writes one inline, so
+treat `mcp.json` as safe to commit or sync only when every entry in it uses a
+variable reference. The bridge expands the reference from its own environment
+at load time (see [Environment variables](#environment-variables));
 with `SERPLY_API_KEY` unset, this server is disabled and reported by name while
 every other server keeps working. Get a key at
 [serply.io](https://serply.io); the API reference is at