Azure AI Foundry Agent Unable to Use Credentials Stored in Key Vault Through Playwright MCP Tool

I agree with the points above. The key distinction is that Key Vault is a secret storage service, not a secret injection mechanism for agents or MCP tools. The agent can decide when to call a tool, but it should not be responsible for retrieving and handling credentials directly.

A cleaner architecture would be to give the MCP server its own managed identity with limited Key Vault access, retrieve the credential at execution time, and keep the secret boundary inside the tool. This also makes auditing easier since you can track which tool accessed which secret and avoid credentials appearing in prompts, traces, or model context.