Best practices for AI agent tools
Short, practical guides on using MCP servers, agent skills and coding agents well and securely. Each one starts from a real incident or a real question, with steps you can copy and a checklist.
- Secrets and tokens
Move Trading API Keys for Vibe-Trading Out of Plain-Text Config
You will take the TRADING_API_KEY and TRADING_API_SECRET values out of the plain-text mcpServers config and load them from a secret store at launch. This lowers the chance that a trading credential leaks through a shared or committed config file.
AgentArmor team - Secrets and tokens
Pass TrendRadar API keys as environment variables, not in Docker commands
You will run TrendRadar in Docker without typing API keys into the command line or committing them to files. Keeping secrets out of shell history and version control lowers the chance they leak.
AgentArmor team - Secrets and tokens
Check Credential Handling in mcp-use Before Connecting Real Accounts
You will confirm the package source and test credential handling with a throwaway token before connecting real services. This reduces risk of token exposure, since the directory entry flags credential exposure as a key risk.
AgentArmor team - Secrets and tokens
Move your Firecrawl API key out of shared MCP config files
You will find where the Firecrawl API key appears in shared MCP configuration and move it to private storage. This matters because a key sitting in a shared file can be copied, committed, or exposed, and a leaked key can drain your quota and billing.
AgentArmor team - Secrets and tokens
Pass API tokens at runtime instead of baking them into images
You will run MCP servers with tokens injected at container start, keeping secrets out of image layers, shell history and process listings. This lowers the chance that a leaked image or command line exposes your credentials.
AgentArmor team - Secrets and tokens
Verify MCP server tokens with a direct API call first
You will test a token against its target API with a plain HTTP request before passing it into an MCP server or transport. This shows whether a failure comes from the token or from the MCP setup.
AgentArmor team - Secrets and tokens
Reject empty bearer tokens and replace placeholders on HTTP MCP servers
You will upgrade @zereight/mcp-gitlab, turn off dynamic API URL support, and make your HTTP MCP servers reject empty bearer tokens and placeholder secrets. This reduces risk of a web page reaching your GitLab Private-Token.
AgentArmor team - Secrets and tokens
Allowlist GitLab API base URLs so tokens never reach unknown hosts
You will fix the GitLab base URL to hosts you choose, so your token goes only where you intend. This lowers the risk of a tool sending it somewhere unexpected.
AgentArmor team