The default MCP read response contains plaintext. With responseFormat: "reference", the server instead returns a credentialReference containing a vault:lease: reference, a preview and metadata.

Client support is required

A reference is useful only when the consuming runtime implements the corresponding secret-substitution path. That runtime must resolve it for the authorized downstream operation without placing the value in the model transcript or logs. A generic MCP client can pass the reference string literally and fail; MCP compatibility alone does not prove support.

Use a fictional credential to verify the actual client and downstream tool before relying on references. Check expiry, single-use handling, failure behavior and logging. Do not label an integration safe merely because its response omitted a visible secret.

The CLI offers a separate process-injection path through vault exec. That mechanism also needs a consumer that avoids printing injected values. The SDK returns plaintext to the trusted application and leaves its handling to that application.

A reference does not change the underlying authorization or provider validity. Lease expiry and revocation cannot invalidate a value already delivered to a consumer.

Screen reference

Open this screenshot at full size.