pick.tools

Security

The pass-through model

pick.tools holds no vendor credentials. When a server needs a key, you send it with each request in X-Pick-Key-<slug>. pick.tools puts it where that vendor's server expects it, makes the upstream request and drops it. It is never stored, logged, cached or echoed in errors, and every X-Pick-* header is redacted from logs and error reports.

pick.tools contacts the URLs in its catalog and no others. Scheme and host come from the catalog; a key can fill a {key} slot in a catalogued URL and nothing more. Redirects to other hosts are not followed. Request bodies are capped at 1 MiB.

Token passthrough

The MCP security guidance forbids token passthrough: a server must not forward the token that a client used to authorize to it. pick.tools does not do this. It never forwards the MCP client's own authorization token: Authorization on a request to pick.tools is never forwarded, and v1 issues no tokens of its own.

An X-Pick-Key-<slug> value is a different thing: a vendor credential that you address to one named vendor, and that pick.tools relays to that vendor alone. Relaying it is still a grey area, and we say so. The mitigations:

  • every upstream request names pick.tools in User-Agent and carries X-Forwarded-For;
  • the egress IPs and user agents are published on For vendors, and a vendor can opt out within one business day;
  • key values are never stored, logged, cached or echoed;
  • a key for one service is never sent to another.

The pattern the MCP specification prefers, URL-mode elicitation with server-side encrypted storage bound to an identity, is on the roadmap.

Why OAuth servers are not relayed in v1

Relaying an OAuth server means registering pick.tools as an OAuth client with each vendor and keeping encrypted tokens bound to a pick.tools identity, and v1 has no accounts and stores no credentials. So for an OAuth server, the agent gets the vendor's own URL and connects to it directly; a server that also accepts a static personal token is relayed like an API-key server and labelled "API token (static)".

Report a vulnerability

Contact: not published yet. Please include steps to reproduce, and do not disclose the issue publicly until it is fixed.