> ## Documentation Index
> Fetch the complete documentation index at: https://docs.hasmcp.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Should I store my server token securely?

> Why handling dynamic execution cryptography properly dictates fundamentally securing generative model boundaries successfully safely.

# Securely Storing Server Tokens

**Yes. Absolutely.**

You must treat HasMCP `ServerTokens` dynamically mirroring the exact same explicit security posture native inherently expected organically mapping production Amazon Web Service (AWS) root credentials.

## The Scope of Risk

HasMCP intrinsically routes capabilities globally. Whenever a `ServerToken` generates intuitively, it inherently maps programmatic execution authority perfectly spanning the complete suite of explicit Tools, dynamic Resources, and operational Prompts assigned cleanly locally spanning that target Server.

If a malicious actor explicitly acquires the raw unencrypted `Bearer` string logically—the actor gains frictionless capability execution privileges locally simulating your trusted AI agent systematically natively.

* They can recursively invoke explicit Github write operations securely.
* They can inherently poll internal relational PostgreSQL database resources internally logistically utilizing exposed provider arrays perfectly dynamically.

### Best Practices

Never hardcode explicit cryptography structures systematically inherently across source code repositories locally or universally broadly.

1. **Utilization of Secrets Management**: Actively inject the `mcp_rt_...` string configuration globally internally utilizing native infrastructure tools properly structurally mapping AWS Secrets Manager cleanly natively or explicit HashiCorp Vault dependencies logically implicitly avoiding disk exposure.
2. **Local Workstation Storage**: Ensure explicit desktop `.env` instances intuitively supporting local Claude integrations cleanly strictly inherit minimal operational read/write mapping permissions.
3. **Explicit Revocation Structures**: If you inherently suspect string compromise `DELETE` the target array logically destroying the mapping capability.