docs(mcp-bridge): scope the commit-safety note to the serply entry

The serply template writes ${SERPLY_API_KEY} rather than the key, but the note
claimed the whole of mcp.json stays safe to commit. Other entries can hold a
literal credential, including the you.com example directly above it, so the
claim now covers the entry and states the condition for the file.

commit: 3a3f2593e2bd2b25589d8a228f8836b126f0baa6
author: serply · 34d ago · 2026-09-18 14:40 UTC
parent: aed6edb
signature: GPG Unverified2A6F1A7240DDE6DB The key is unknown

1 file · +6 -3

M examples/extensions/mcp-bridge/README.md +6 -3


@@ -287,9 +287,12 @@ is the first one that writes a `headers` entry:
287	287		}
288	288		```
289	289
290		-	The template writes the variable reference, not the key, so `mcp.json` holds no
291		-	secret and stays safe to commit or sync. The bridge expands it from its own
292		-	environment at load time (see [Environment variables](#environment-variables));
	290	+	The template writes the variable reference, not the key, so this entry holds no
	291	+	secret. The file around it is a separate question: another server can hold a
	292	+	literal credential, the way the You.com example above writes one inline, so
	293	+	treat `mcp.json` as safe to commit or sync only when every entry in it uses a
	294	+	variable reference. The bridge expands the reference from its own environment
	295	+	at load time (see [Environment variables](#environment-variables));
293	296		with `SERPLY_API_KEY` unset, this server is disabled and reported by name while
294	297		every other server keeps working. Get a key at
295	298		[serply.io](https://serply.io); the API reference is at

 }
 ```
-The template writes the variable reference, not the key, so `mcp.json` holds no
+The template writes the variable reference, not the key, so this entry holds no
-secret and stays safe to commit or sync. The bridge expands it from its own
+secret. The file around it is a separate question: another server can hold a
-environment at load time (see [Environment variables](#environment-variables));
+literal credential, the way the You.com example above writes one inline, so
+treat `mcp.json` as safe to commit or sync only when every entry in it uses a
+variable reference. The bridge expands the reference from its own environment
+at load time (see [Environment variables](#environment-variables));
 with `SERPLY_API_KEY` unset, this server is disabled and reported by name while
 every other server keeps working. Get a key at
 [serply.io](https://serply.io); the API reference is at