// CREDENTIALS
Isolating Credentials in AI Workflows via HSM Vaults
Prevent prompt injections from exposing access keys. Discover the server-side credential hydration pattern for Model Context Protocol (MCP).
By MakeYourMCP Team · Published Jul 1, 2025 · Updated Jul 1, 2025
If an AI agent has access to raw API keys or database password strings inside its prompt context, those credentials can be leaked to malicious actors via prompt injection attacks. Preventing credential leaks requires separating client-side logic from credential hydration.
The Server-Side Hydration Pattern
MakeYourMCP addresses this threat vector by introducing an isolated Hardware Security Module (HSM) credential vault:
- The developer configures the Postgres or Slack connector inside MakeYourMCP, storing the credentials in our secure vault.
- The gateway advertises only logical tool references (e.g.
get_postgres_table) to the agent context. - When the agent issues a tool call, the gateway validates permissions, fetches the token from the vault, hydates the connection server-side, executes the request, and returns only the sanitized result.
The LLM and prompt contexts remain completely blind to all credentials, making API token leaks impossible.
Related Guides: