fix: redact API key in deploy MCP config output

[Fishbone23333]

Summary

• Replace the live deployment API key in the printed MCP configuration example with <YOUR_API_KEY>.
• Add a small helper for building the display-only MCP config so credential redaction is centralized.
• Add regression coverage for both the helper and the CLI output path to ensure the live key is not printed to stdout.

Related Issue

Fixes #669

Verification

• uv run ruff format src\mcp_agent\cli\cloud\commands\deploy\main.py tests\cli\commands\test_deploy_command.py
• uv run ruff check src\mcp_agent\cli\cloud\commands\deploy\main.py tests\cli\commands\test_deploy_command.py
• uv run pytest tests\cli\commands\test_deploy_command.py -q -k "redacts_api_key or placeholder or deploy_command_basic"
• git diff --check

Notes

• The live API key is still used for deployment API calls; only the copied terminal example is redacted.
• Focused tests passed with 3 passed, 13 deselected.
• Running the full tests\cli\commands\test_deploy_command.py file on native Windows produced an unrelated existing failure in test_deploy_uses_cwd_mcpacignore_when_config_dir_lacks_one: the test changes into a TemporaryDirectory, then Windows refuses to remove the current working directory during cleanup.

Summary by CodeRabbit

• Bug Fixes

  • Deploy command now shows a placeholder API key in MCP server configuration examples instead of actual credentials, preventing accidental exposure.
  • Console output during deployment provides clearer instructions for replacing the placeholder with your real API key.

• Tests

  • Added tests to verify the placeholder is used and that live API keys are not printed to stdout.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro

Run ID: 12d48d66-d3d0-4c21-bb84-8b7116c1e696

📥 Commits

Reviewing files that changed from the base of the PR and between b79cef0 and 8a5db15.

📒 Files selected for processing (1)

• src/mcp_agent/cli/cloud/commands/deploy/main.py

🚧 Files skipped from review as they are similar to previous changes (1)

• src/mcp_agent/cli/cloud/commands/deploy/main.py

---

📝 Walkthrough

Walkthrough

The deploy CLI no longer prints live API keys. A DISPLAY_API_KEY_PLACEHOLDER and create_mcp_config_example(app_name, server_url) produce the MCP config example with a placeholder Authorization header; deploy output now uses that helper. Tests were added to verify no live key is emitted.

Changes

API Key Redaction in Deploy Output

Layer / File(s)	Summary
Placeholder constant and config example helper src/mcp_agent/cli/cloud/commands/deploy/main.py	DISPLAY_API_KEY_PLACEHOLDER and create_mcp_config_example(app_name, server_url) generate MCP mcpServers JSON with the placeholder in the Authorization header.
Deploy command integration with placeholder src/mcp_agent/cli/cloud/commands/deploy/main.py	Deploy output now calls create_mcp_config_example() and updates console text to instruct users to replace the placeholder instead of printing the effective API key.
Test coverage for API key redaction tests/cli/commands/test_deploy_command.py	Adds imports and tests that assert the generated MCP config uses the placeholder (not the live key) and the deploy command output does not include the live API key while still displaying the placeholder Authorization value and SSE URL.

Estimated code review effort

🎯 3 (Moderate) | ⏱️ ~20 minutes

Suggested reviewers

• saqadri

Poem

🐰 I hid the key behind a friendly cue,
A placeholder where the secret grew,
Deploy prints safe, no token shown,
Quiet trails and logs unknown,
Hop, skip, secure — the rabbit’s due! 🥕✨

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 62.50% which is insufficient. The required threshold is 80.00%.	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title accurately summarizes the main change: redacting the API key in the deploy MCP config output to prevent credential exposure in logs and terminal history.
Linked Issues check	✅ Passed	The PR directly addresses issue #669 by replacing the live API key with a placeholder in the printed MCP config, adding a helper function for centralized credential redaction, and including regression tests to prevent key leakage.
Out of Scope Changes check	✅ Passed	All changes align with the stated objective: new constant and helper function for config display, updated deploy output logic to use the placeholder, and regression tests validating the redaction behavior.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[coderabbitai]

🧹 Nitpick comments (1)

src/mcp_agent/cli/cloud/commands/deploy/main.py (1)

474-476: 💤 Low value

Consider clarifying which API key users should substitute.

The message instructs users to replace the placeholder "with your API key" but doesn't specify whether this should be:

• The same API key used for deployment authentication
• A new key they need to generate
• A project-specific key

Adding a brief clarification could reduce user confusion when copying the configuration.

📝 Suggested clarification

 print_info(
     f"Use this app as an MCP server at {server_url}/sse\n\n"
     "MCP configuration example "
-    f"(replace {DISPLAY_API_KEY_PLACEHOLDER} with your API key):"
+    f"(replace {DISPLAY_API_KEY_PLACEHOLDER} with your authentication API key):"
 )

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@src/mcp_agent/cli/cloud/commands/deploy/main.py` around lines 474 - 476,
Update the help message that prints the MCP configuration (the f-string
containing server_url and DISPLAY_API_KEY_PLACEHOLDER) to clarify which API key
to substitute: explicitly state that DISPLAY_API_KEY_PLACEHOLDER should be
replaced with the API key for the MCP server (the project/service API key used
to authenticate clients to this MCP instance), and indicate whether it must be
the same key used for deployment or a separate project-specific key (e.g.,
"replace {DISPLAY_API_KEY_PLACEHOLDER} with your MCP server/project API key —
not the deployment-only token"). Modify the string near where server_url and
DISPLAY_API_KEY_PLACEHOLDER are formatted so users know which key to provide.

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Nitpick comments:
In `@src/mcp_agent/cli/cloud/commands/deploy/main.py`:
- Around line 474-476: Update the help message that prints the MCP configuration
(the f-string containing server_url and DISPLAY_API_KEY_PLACEHOLDER) to clarify
which API key to substitute: explicitly state that DISPLAY_API_KEY_PLACEHOLDER
should be replaced with the API key for the MCP server (the project/service API
key used to authenticate clients to this MCP instance), and indicate whether it
must be the same key used for deployment or a separate project-specific key
(e.g., "replace {DISPLAY_API_KEY_PLACEHOLDER} with your MCP server/project API
key — not the deployment-only token"). Modify the string near where server_url
and DISPLAY_API_KEY_PLACEHOLDER are formatted so users know which key to
provide.

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro

Run ID: e7bf871a-9dac-4f38-b0dc-e4ea10043c06

📥 Commits

Reviewing files that changed from the base of the PR and between f62d849 and b79cef0.

📒 Files selected for processing (2)

• src/mcp_agent/cli/cloud/commands/deploy/main.py
• tests/cli/commands/test_deploy_command.py