Key handling

Wasit signs with keys you supply. It needs them to do its job, and it does the minimum with them.

• Keys are read from the process environment only. Never from a command argument, never from a config file committed to a repository.
• Keys are never accepted as MCP tool arguments. Every tool reads what it needs from the server's own environment, so an agent never handles a key and a key can never end up in a conversation transcript. A missing key returns an error naming the variable to set, not a prompt to supply one.
• Keys are never logged, persisted, or transmitted anywhere except to the Stellar network as part of a signed transaction. Check output reports public keys and transaction hashes; it does not report secrets.
• .env is gitignored. .env.example documents every variable by name with no values.

Use a dedicated testnet account with only as much balance as the run needs. Do not reuse a key that has any other purpose.