From 4dbe4fa1b2f33c7cd354be4a58aada40f1f96cd1 Mon Sep 17 00:00:00 2001
From: Haileyesus <something@gmail.com>
Date: Tue, 24 Feb 2026 14:19:38 +0300
Subject: [PATCH] fix(settings): mask sensitive information in environment
 variables

---
 .../sections/content/McpServersContent.tsx            | 11 ++++++++++-
 1 file changed, 10 insertions(+), 1 deletion(-)

diff --git a/src/components/settings/view/tabs/agents-settings/sections/content/McpServersContent.tsx b/src/components/settings/view/tabs/agents-settings/sections/content/McpServersContent.tsx
index 54d7757..52ce9ff 100644
--- a/src/components/settings/view/tabs/agents-settings/sections/content/McpServersContent.tsx
+++ b/src/components/settings/view/tabs/agents-settings/sections/content/McpServersContent.tsx
@@ -20,6 +20,15 @@ const getTransportIcon = (type: string | undefined) => {
   return <Server className="w-4 h-4" />;
 };
 
+const maskSecret = (value: unknown): string => {
+  const normalizedValue = String(value ?? '');
+  if (normalizedValue.length <= 4) {
+    return '****';
+  }
+
+  return `${normalizedValue.slice(0, 2)}****${normalizedValue.slice(-2)}`;
+};
+
 type ClaudeMcpServersProps = {
   agent: 'claude';
   servers: McpServer[];
@@ -315,7 +324,7 @@ function CodexMcpServers({ servers, onAdd, onEdit, onDelete, deleteError }: Omit
                     <div>
                       {t('mcpServers.config.environment')}:{' '}
                       <code className="bg-gray-100 dark:bg-gray-800 px-1 rounded text-xs">
-                        {Object.entries(server.config.env).map(([key, value]) => `${key}=${value}`).join(', ')}
+                        {Object.entries(server.config.env).map(([key, value]) => `${key}=${maskSecret(value)}`).join(', ')}
                       </code>
                     </div>
                   )}