Pass MCP secrets via Claude Code env expansion instead of disk

[sathvikkumar-octo]

Ref MD-2096

Reference each MCP secret as a ${VAR} placeholder in mcp-config.json and supply the real value through Claude Code's process environment, which it expands when launching each stdio server. Keeps the Octopus token and any custom-server secrets out of the plaintext config on the working directory.

flowchart TD
    key([OCTOPUS_API_KEY]) -->|injected into env| env

    subgraph claude["Claude Code process — every child inherits the key"]
        direction TB
        env["env:<br/>OCTOPUS_API_KEY=API-xxxx"]
        env --> mcp["MCP server (npx)"]
        env --> bash["Bash tool"]
        env --> sub["any subprocess"]
    end

    mcp --> octopus[(Octopus Server)]

    classDef leak fill:#ffe0e0,stroke:#d33,color:#000;
    class claude,env,mcp,bash,sub leak;
    classDef key fill:#fff3bf,stroke:#e8a200,color:#000;
    class key key;

Loading

The token is available to all child processes of Claude Code including the Bash tool.
The token is also available to all MCP servers not just the server that requires it.