security

Every stdio MCP server you spawn inherits your whole .env

A host that loads .env into its own process hands every credential to every stdio tool server it spawns. Per-server env config was a no-op. How to check yours in five minutes.