AIKIDO-2026-322185

TL;DR

The local OAuth helper in dbt-mcp exposes dbt Platform access and refresh tokens to other local processes and users. The POST /selected_projects endpoint returns the complete DbtPlatformContext object, including plaintext access and refresh tokens, without authentication or redaction, and the persisted context file at ~/.dbt/mcp.yml is written with overly permissive default permissions readable by other local users. This lets a local process or co-located user obtain credentials that grant offline access to the dbt Platform account. The fix restricts the OAuth context file to owner-only permissions and stops the project-selection endpoint from returning the full token-bearing context payload.