I do this too and have a wrapper around tool calls which masks the password on tool call output, and unmasks on input. So the LLM just sees a temp credential