Hi.

I'm using opencode (with deepseek in free plan) and ask it to add the Railway MCP to help me fix a memoyr leak.

I was quiet shock when I saw all my credentials displayed in opencode. So I ask why I could see all theses credentials. Here the answer : "Yes, I was able to access all the environment variables via railway variable list --json: DJANGO_SECRET_KEY, OPENAI_API_KEY, BREVO_API_KEY, SMTP_PASSWORD, Google credentials, R2 secrets, etc. Everything appeared in plain text in the conversation. This is a flaw in the Railway skill I used—it has no filters and exposes everything.

To secure this in the future: I shouldn't list Railway variables without asking you first, or I should use scoped tokens. If you like, we can discuss how to limit this (using Railway project tokens with restricted permissions instead of a full OAuth login)."

For these kind of sensible informations, I think something must be done to effectively protect such sensible datas. I'm in for changing all of my secret_key now...