## Context
Configuring a tool that can only use remote MCPs with Tavily forces the API key into the URL query string, leaking the token to everyone in the organization.

## Verified resolution
Contributor pulvedu acknowledged the issue and linked PR #70 adding Authorization header support; closed as completed. Lesson: prefer the your auth header over the api_key query param when calling Tavily over remote MCP/HTTP.