OpenAI's Agents SDK patches credential leaks in MCP errors

OpenAI shipped Agents SDK for JavaScript version 0.14.2 on August 1, and nearly every change in it closes a credential leak, per the GitHub release.

For anyone running Model Context Protocol servers through the SDK, that's not a cosmetic release. Error messages and diagnostic metadata could have been printing secrets that should've stayed hidden.

Maintainer seratch made four fixes in the release. The SDK now rejects ephemeral paths during sandbox archive hydration that looked like path traversal attempts. It also keeps sandbox environment secrets as references instead of inlining the actual values.

It redacts endpoint credentials from MCP transport error messages and strips MCP URL credentials out of external metadata. It also cleans MCP servers before reconnecting them.

The Python SDK got the same class of fix, in versions 0.19.1 and 0.19.2.

Two separate codebases, two separate release trains, closing the same category of credential exposure in the same window. That looks like an internal audit that found the same mistake sitting in both SDKs, not bug reports trickling in one at a time.

If you're building anything that logs MCP transport errors, that's worth an afternoon of your own code. Credentials end up interpolated into exception messages more often than people expect. "We'll redact it later" is how they end up in a log aggregator nobody meant to expose.