Pasting a credential into a chat window puts it in the conversation history, which is a different security posture from a config file. DeskDay says so rather than leaving you to find out. On the design: discovery plus a generic executor means the whole API is reachable with four tool definitions, which is efficient — and it also means the key is the only boundary, since there is no per-operation scoping in the tool surface.
DeskDay's endpoint, which listed four tools to our probe. Rather than a tool per operation, it exposes discovery over the API surface plus a generic executor.
- list-endpoints — every API path and method with summaries, paginated
- get-endpoint — one endpoint in detail, including its security schemes and servers
- search-endpoints — a deep search through paths, operations and parameters
- execute-request — run an API request from a HAR request object
A bearer API key beginning dd_pk. The vendor warns explicitly that some clients require pasting the key into a chat, which can expose it in the conversation — worth reading before you connect.
Paste a URL with a key — add the endpoint to your client