Please don't open a public issue for a vulnerability. Report it privately through GitHub's security advisory form.

tool-bench runs third-party MCP servers against local mock APIs. The credentials in catalog/services.toml, servers/ and the scenario datasets are placeholders, not real secrets.