Summary
pkg/tools/mcp/gateway.go:76-121 writes plaintext secret values to os.CreateTemp files (0600) passed by path to docker mcp gateway run; removal happens only in Stop (gateway.go:58, 63-72). A crash/SIGKILL leaves secrets on disk indefinitely.
Fix
Startup sweep of stale mcp-secrets-* / mcp-config-* files; evaluate passing secrets via stdin/fd instead of a path (keep the file path as a fallback for gateway compatibility).
Acceptance
- Stale secret files cleaned on startup; no plaintext secret persists after abnormal exit (where feasible).
Summary
pkg/tools/mcp/gateway.go:76-121writes plaintext secret values toos.CreateTempfiles (0600) passed by path todocker mcp gateway run; removal happens only inStop(gateway.go:58, 63-72). A crash/SIGKILL leaves secrets on disk indefinitely.Fix
Startup sweep of stale
mcp-secrets-*/mcp-config-*files; evaluate passing secrets via stdin/fd instead of a path (keep the file path as a fallback for gateway compatibility).Acceptance