The MCP server starts with an empty environment

Your customers add MCP servers to their agents: a Jira connector, a Postgres tool, something from a blog post. A stdio server is an ordinary subprocess. Whatever sits in the parent's environment would normally be its to read.

In a Hoody container it starts scrubbed. No provider API key, no platform token reaches it by inheritance. If the GitHub server needs a token, the config names it: "env": {"GITHUB_TOKEN": "${GITHUB_TOKEN}"}, and that one variable, read from the daemon's environment, is all it gets. A ${VAR} written in args or url is not substituted, so a secret can't leak through the wrong field by accident.

The blog-post server runs and does its job. It can't enumerate the credentials of the agent that launched it, because it was handed exactly one, on purpose.

Secrets reach a tool by name, never by inheritance.