SEC-003: Responses carry no secrets

Severity	Applies to	Spec section
warn	both eras, stdio, http	2026-07-28/server/tools#security-considerations

Judged from the SEC-002 traffic. Fails if a value passed to a stdio server with --env (8 characters or longer) comes back in an answer, or if an answer contains something shaped like a credential: an AWS access key, a GitHub, Slack, Stripe live or sk- API token, a Google API key, a private key block, or a JSON Web Token. Servers MUST sanitize tool outputs. The report names the kind of secret and shows at most its first four characters, and the value is masked in the saved recording. A heuristic, so a warning. Runs once per server.

From the command line: mcpprobe checks explain SEC-003. To leave it out of a run, add "SEC-003" to [checks] disable in mcpprobe.toml; to change how much it counts, use severity_overrides.