Every MCP credential on this account

What each credential may do, what it may touch, its daily budget and what is left of it, when it was last used, and which credential minted it. The token itself is never returned — not here and not anywhere. Since 25 September 2026 it also reports the monthly budget and its remainder, per-credential resource quotas, and the human user answerable for the credential (owner).

state separates a revoked credential from an expired one: both are dead, and a caller deciding what to clean up wants them told apart.