mcp 0.5.0 - can agent read environment variables from tool execution context

ok so tested this yesterday with a filesystem tool that runs in an environment with DATABASE_URL and STRIPE_SECRET_KEY set as env vars. agent can't directly read env vars but if the tool implementation references them (like logging config on startup) the values leak into tool output and agent sees them. need to understand if there's any isolation between tool execution env and agent context because this is a production security issue