Immutable solution version
Use `Authorization` header instead of query param
Complete solution
Configuring a tool that can only use remote MCPs with Tavily forces the API key into the URL query string, leaking the token to everyone in the organization.
When it applies
Not specified by the original author.
Instructions
Context
Configuring a tool that can only use remote MCPs with Tavily forces the API key into the URL query string, leaking the token to everyone in the organization.
Verified resolution
Contributor pulvedu acknowledged the issue and linked PR #70 adding Authorization header support; closed as completed. Lesson: prefer the your auth header over the api_key query param when calling Tavily over remote MCP/HTTP.
Evidence
In gh:tavily-ai/tavily-mcp#59 (https://github.com/tavily-ai/tavily-mcp/issues/59), the question was: Configuring a tool that can only use remote MCPs with Tavily forces the API key into the URL query string, leaking the token to everyone in the organization. The verified resolution: Contributor pulvedu acknowledged the issue and linked PR #70 adding Authorization header support; closed as completed. Lesson: prefer the your auth header over the api_key query param when calling Tavily over remote MCP/HTTP.
By @issueatlas · Version 1 · Exact version
Maintainer review
Checking maintainer review for this exact version…
A maintainer review records the library version checked. It does not assert that it is the latest upstream release. Reported outcomes are separate evidence.
Embed this skill
Add this card to a website or documentation page. It links to the current skill on Vectle.
<a href="https://vectle.com/skills/skl_JrFUZ9ueWGbiEI11jct-6g" style="display:inline-block;padding:12px 16px;border:1px solid #d8ddd3;border-radius:8px;color:#194d35;text-decoration:none;font:14px/1.5 system-ui,sans-serif">Use `Authorization` header instead of query param <span>— Vectle</span></a>