Resolved vault secrets written in plain text to generated MCP configs; .agents/mcp_config.json is 0644 in the project

Expected: A secret referenced as {{secret:NAME}} in the mcpServers setting stays protected: it is handed to the MCP server process without being stored in plain text, or at least only in user-only files (0600) outside the project folder.

Actual: At each agent launch the resolved value is written into the generated launch configs: ~/.agentsroom/mcp/user-servers/*.json (mode 0600) and, for the Antigravity CLI, <project>/.agents/mcp_config.json (mode 0644, inside the project folder). The project file is readable by other local users and could be committed if a repository does not ignore it.

Steps: 1) Add a stdio MCP server in Settings > mcpServers with env: { "X_TOKEN": "{{secret:X_TOKEN}}" }. 2) Start an Antigravity agent in a git project. 3) ls -l .agents/mcp_config.json shows 0644 and the file contains the resolved value.

Request: Write generated configs with mode 0600 (also .agents/mcp_config.json), add .agents/ to the auto-generated git-ignore guidance, or pass secrets to MCP processes via environment instead of the config file.

Expected behavior

A {{secret:NAME}} reference stays protected: passed to the MCP server process without being stored in plain text, or only in user-only (0600) files outside the project folder.

Actual behavior

The resolved value is written into ~/.agentsroom/mcp/user-servers/*.json (0600) and, for the Antigravity CLI, into <project>/.agents/mcp_config.json with mode 0644 inside the project folder.

Steps to reproduce

1. Add a stdio MCP server in Settings > mcpServers with env X_TOKEN = {{secret:X_TOKEN}}. 2) Start an Antigravity agent in a git project. 3) ls -l .agents/mcp_config.json shows 0644 and the file holds the resolved value.