LLMs don't need your secret tokens (but MCP servers hand them over anyway)