I’m curious, how do you handle authorization of the user without leaking tokens/api keys to model context without an MCP server (which supports OAuth, in principle)?