diff --git a/backend/agents/create_agent_info.py b/backend/agents/create_agent_info.py
index 474044f89..0d7fc6a40 100644
--- a/backend/agents/create_agent_info.py
+++ b/backend/agents/create_agent_info.py
@@ -1413,6 +1413,9 @@ async def create_tool_config_list(
                 "api_key": AIDP_API_KEY,
                 "tenant_id": AIDP_TENANT_ID,
             })
+            param_dict.pop("server_url", None)
+            param_dict.pop("api_key", None)
+            param_dict.pop("tenant_id", None)
 
         # v7.1: inject the runtime whitelist for AidpSearchTool. The
         # permission service recomputes it on every agent call so per-KB
@@ -1458,7 +1461,7 @@ async def create_tool_config_list(
             existing = tool_config.metadata if isinstance(tool_config.metadata, dict) else {}
             tool_config.metadata = {
                 **existing,
-                "allowed_kds_set": _allowed_kds_set,
+                "allowed_kds_set": list(_allowed_kds_set),
                 "kds_name_to_id_map": _kds_name_to_id_map,
             }
             tool_class_name = tool.get("class_name")
diff --git a/sdk/nexent/core/agents/nexent_agent.py b/sdk/nexent/core/agents/nexent_agent.py
index d1da018fb..40bb0165f 100644
--- a/sdk/nexent/core/agents/nexent_agent.py
+++ b/sdk/nexent/core/agents/nexent_agent.py
@@ -4,6 +4,7 @@
 import inspect
 import json
 import logging
+import os
 import re
 import time
 from dataclasses import replace
@@ -343,6 +344,9 @@ def create_local_tool(self, tool_config: ToolConfig):
                 # kds_name_to_id_map is exclude=True; inject via metadata after init
                 filtered_params = {k: v for k, v in params.items()
                                    if k not in ["kds_name_to_id_map"]}
+                filtered_params["server_url"] = os.getenv("AIDP_SERVER_URL", "")
+                filtered_params["api_key"] = os.getenv("AIDP_API_KEY", "")
+                filtered_params["tenant_id"] = os.getenv("AIDP_TENANT_ID", "aidp")
                 tools_obj = tool_class(**filtered_params)
                 tools_obj.observer = self.observer
                 tools_obj.kds_name_to_id_map = tool_config.metadata.get(
diff --git a/test/backend/agents/test_create_agent_info.py b/test/backend/agents/test_create_agent_info.py
index bc4c26845..33cef943e 100644
--- a/test/backend/agents/test_create_agent_info.py
+++ b/test/backend/agents/test_create_agent_info.py
@@ -7138,10 +7138,11 @@ def capture_and_return(**kwargs):
             )
 
             assert len(result) == 1
-            # Verify env creds are in the params (overriding stale DB values)
-            assert mock_tc_instance.params["server_url"] == "https://aidp.test"
-            assert mock_tc_instance.params["api_key"] == "key-123"
-            assert mock_tc_instance.params["tenant_id"] == "aidp-tenant"
+            # Verify env creds were injected then removed from params
+            # (runtime params are handled by nexent_agent.py at tool creation time)
+            assert "server_url" not in mock_tc_instance.params
+            assert "api_key" not in mock_tc_instance.params
+            assert "tenant_id" not in mock_tc_instance.params
 
     @pytest.mark.asyncio
     async def test_aidp_search_permission_whitelist_success(self):
@@ -7194,7 +7195,7 @@ def capture_and_return(**kwargs):
             assert len(result) == 1
             assert mock_tc_instance.metadata is not None
             assert "allowed_kds_set" in mock_tc_instance.metadata
-            assert mock_tc_instance.metadata["allowed_kds_set"] == {"kb_allowed_1", "kb_allowed_2"}
+            assert set(mock_tc_instance.metadata["allowed_kds_set"]) == {"kb_allowed_1", "kb_allowed_2"}
 
     @pytest.mark.asyncio
     async def test_aidp_search_permission_whitelist_failure_fallback(self):
@@ -7247,7 +7248,7 @@ def capture_and_return(**kwargs):
             assert len(result) == 1
             # allowed_kds_set should be empty set on failure
             assert mock_tc_instance.metadata is not None
-            assert mock_tc_instance.metadata["allowed_kds_set"] == set()
+            assert mock_tc_instance.metadata["allowed_kds_set"] == []
 
     @pytest.mark.asyncio
     async def test_aidp_search_metadata_merges_langchain_tool(self):
diff --git a/test/sdk/core/agents/test_nexent_agent.py b/test/sdk/core/agents/test_nexent_agent.py
index 6737c0e23..eb78b7a9b 100644
--- a/test/sdk/core/agents/test_nexent_agent.py
+++ b/test/sdk/core/agents/test_nexent_agent.py
@@ -5058,7 +5058,12 @@ def test_aidp_search_tool_with_allowed_kds_set(self, nexent_agent_instance):
                 del nexent_agent.__dict__["AidpSearchTool"]
 
         assert result is mock_tool_instance
-        mock_tool_class.assert_called_once_with(param1="val")
+        mock_tool_class.assert_called_once_with(
+            param1="val",
+            server_url="",
+            api_key="",
+            tenant_id="aidp",
+        )
         mock_tool_instance.set_allowed_kds.assert_called_once_with(["kb1", "kb2"])
         assert mock_tool_instance.observer == nexent_agent_instance.observer