MCP authentication token theft via headers

MCP servers that accept authentication tokens in headers can leak those tokens if the server logs requests, shares telemetry, or is compromised. Tokens passed to MCP servers persist in server-side logs and may be accessible to attackers.