Last reviewed
Correct answer: A. URL mode, so the credential is entered out of band and never passes through the client.
Explanation
The principle — Where sensitive data travels matters more than how it is displayed.
Why the key is correct — The specification states it as a prohibition: privacy considerations: servers must not use form mode to request sensitive information such as passwords, API keys, access tokens, or payment credentials. And it names the alternative — those interactions belong in URL mode, which keeps the data out of band so it never passes through the client or the LLM context. An API key is on the list by name, so this is not a judgement call.
Why the others are wrong — Masking changes what is rendered, not what is transmitted. Encryption protects the channel, not the fact that the value entered the client and the model's context. And the rule binds the server rather than leaving each client to decide.
Remember this — Credentials go out of band, or they do not go.
Sources — MCP first-party documentation.
Sources
“Privacy considerations: Servers must not use form mode to request sensitive information such as passwords, API keys, access tokens, or payment credentials.”
“Those interactions belong in URL mode, which keeps the data out of band so it never passes through the client or the LLM context.”
Practise 10 questions on this topic
Take MCP Fundamentals — Timed Test 1 (10 questions) — scored instantly, explanation for every question, no login.