fix: remove detailed 401 response

.changeset/good-geese-start.md

@@ -0,0 +1,5 @@
+---
+"@upstash/context7-mcp": patch
+---
+
+Remove masked API key display from unauthorized error responses

packages/mcp/src/lib/api.ts

@@ -2,7 +2,6 @@ import { SearchResponse } from "./types.js";
 import { generateHeaders } from "./encryption.js";
 import { ProxyAgent, setGlobalDispatcher } from "undici";
 import { DocumentationMode, DOCUMENTATION_MODES } from "./types.js";
-import { maskApiKey } from "./utils.js";
 
 const CONTEXT7_API_BASE_URL = "https://context7.com/api";
 const DEFAULT_TYPE = "txt";
@@ -52,7 +51,7 @@ function createErrorMessage(errorCode: number, apiKey?: string): string {
       if (!apiKey) {
         return "Unauthorized. Please provide an API key.";
       }
-      return `Unauthorized. Please check your API key. The API key you provided (possibly incorrect) is: ${maskApiKey(apiKey)}. API keys should start with 'ctx7sk'`;
+      return `Unauthorized. Please check your API key. API keys should start with 'ctx7sk'`;
     default:
       return `Failed to fetch documentation. Please try again later. Error code: ${errorCode}`;
   }

packages/mcp/src/lib/utils.ts

@@ -67,22 +67,3 @@ export function formatSearchResults(searchResponse: SearchResponse): string {
   const formattedResults = searchResponse.results.map(formatSearchResult);
   return formattedResults.join("\n----------\n");
 }
-
-/**
- * Masks an API key by showing only the first 10 characters and last 4 characters.
- * This prevents full API keys from being exposed in logs while maintaining some
- * identifiability for debugging.
- *
- * @param apiKey The API key to mask
- * @returns Masked API key string (e.g., "ctx7sk-abc...xyz1") or "[NO-API-KEY]" if no key provided
- */
-export function maskApiKey(apiKey: string): string {
-  if (apiKey.length <= 14) {
-    // If the key is too short to mask meaningfully, just show first part
-    return apiKey.substring(0, 7) + "...";
-  }
-
-  const firstPart = apiKey.substring(0, 10);
-  const lastPart = apiKey.substring(apiKey.length - 4);
-  return `${firstPart}...${lastPart}`;
-}