docs(install-claude): "environment variable" examples put the PAT in argv and the saved config

Aperta Adatta ai principianti
  • Qualcosa non va?
#3,758 0 commenti 0 reazioni 0 assegnatari Vedi su GitHub

I maintainer di solito rispondono entro 2 giorni

Nessuno ha ancora preso questa issue.

Valutazione

Difficoltà
2/5
Tempo stimato
1-3 ore
Idoneità per principianti
82/100
Tipo di issue
Documentazione
Chiarezza
Specificata chiaramente
Stato di attività
Attiva
Stack tecnologico
markdown
Ambito
documentation, security

Direzione di ricerca

Inizia con gli esempi di comandi in docs/installation-guides/install-claude.md e l’esempio di configurazione del token in README.md; confronta come ciascuno passa il PAT a Claude Code. Consulta la documentazione sull’espansione delle variabili d’ambiente di Claude Code citata dall’issue per confermare la sintassi supportata. Il lavoro è completato quando tutti gli esempi di variabili d’ambiente elencati mantengono un riferimento a una variabile nella configurazione salvata e non espandono più il PAT negli argomenti del comando.

Scritto dal modello di indicizzazione a partire dal testo della issue.

Descrizione

Problem

Several Claude Code commands in docs/installation-guides/install-claude.md (and one in README.md) expand the personal access token in the shell before Claude Code runs, so the token ends up in the process argument list, in shell history, and as a literal value in the saved MCP configuration:

  • install-claude.md, "With an environment variable (Linux/macOS)": "Bearer '"$GITHUB_PAT"'" closes the single quotes so the shell substitutes the token into the claude mcp add-json argument.
  • install-claude.md, "With an environment variable (Windows PowerShell)": "Bearer $env:GITHUB_PAT" inside a double-quoted string, same effect.
  • install-claude.md, Docker "With an environment variable": -e GITHUB_PERSONAL_ACCESS_TOKEN=$(grep GITHUB_PAT .env | cut -d '=' -f2).
  • install-claude.md, legacy format: -H "Authorization: Bearer $(grep GITHUB_PAT .env | cut -d '=' -f2)", and the PowerShell variant $pat = "YOUR_GITHUB_PAT" followed by -H "Authorization: Bearer $pat".
  • README.md, "Reference the token in configurations": -e GITHUB_PERSONAL_ACCESS_TOKEN=$GITHUB_PAT.

The sections are labelled "With an environment variable", but the stored configuration does not reference the variable; it holds the token itself.

Suggested fix

Claude Code expands ${VAR} references in an MCP server's url, headers, env, command, and args when it connects (Claude Code MCP docs, "Environment variable expansion"). Keeping the reference in single quotes stores ${GITHUB_PAT} literally, so the token stays in the environment and never reaches argv, history, or the config file. Minimal diff, against main at 99d6d6503a7b2a133e2f8a595d6d0ba24b4086d3:

--- a/README.md
+++ b/README.md
@@ -226,8 +226,8 @@
 3. **Reference the token in configurations**
 
    ```bash
-   # CLI usage
-   claude mcp add github -e GITHUB_PERSONAL_ACCESS_TOKEN=$GITHUB_PAT -- docker run -i --rm -e GITHUB_PERSONAL_ACCESS_TOKEN ghcr.io/github/github-mcp-server
+   # CLI usage (single quotes: Claude Code expands ${GITHUB_PAT} at start-up, so the token stays out of argv and the saved config)
+   claude mcp add github -e 'GITHUB_PERSONAL_ACCESS_TOKEN=${GITHUB_PAT}' -- docker run -i --rm -e GITHUB_PERSONAL_ACCESS_TOKEN ghcr.io/github/github-mcp-server
 
    # In config files (where supported)
    "env": {
--- a/docs/installation-guides/install-claude.md
+++ b/docs/installation-guides/install-claude.md
@@ -40,14 +40,16 @@
 With an environment variable (Linux/macOS):
 ```bash
 export GITHUB_PAT="$(grep '^GITHUB_PAT=' .env | cut -d '=' -f2-)"
-claude mcp add-json github '{"type":"http","url":"https://api.githubcopilot.com/mcp","headers":{"Authorization":"Bearer '"$GITHUB_PAT"'"}}'
+claude mcp add-json github '{"type":"http","url":"https://api.githubcopilot.com/mcp","headers":{"Authorization":"Bearer ${GITHUB_PAT}"}}'

+The single quotes keep ${GITHUB_PAT} literal. Claude Code expands it from the environment when it connects, so the token stays out of the command line, shell history, and the saved configuration. Set GITHUB_PAT in the environment Claude Code starts from.
+
With an environment variable (Windows PowerShell):

$githubPatLine = Get-Content .env | Select-String "^\s*GITHUB_PAT\s*=" | Select-Object -First 1
$env:GITHUB_PAT = ($githubPatLine.Line -split "=", 2)[1].Trim().Trim('"').Trim("'")
-claude mcp add-json github "{`"type`":`"http`",`"url`":`"https://api.githubcopilot.com/mcp`",`"headers`":{`"Authorization`":`"Bearer $env:GITHUB_PAT`"}}"
+claude mcp add-json github '{"type":"http","url":"https://api.githubcopilot.com/mcp","headers":{"Authorization":"Bearer ${GITHUB_PAT}"}}'

About the --scope flag (optional): Use this to specify where the configuration is stored:
@@ -80,7 +82,7 @@

With an environment variable:

-claude mcp add github -e GITHUB_PERSONAL_ACCESS_TOKEN=$(grep GITHUB_PAT .env | cut -d '=' -f2) -- docker run -i --rm -e GITHUB_PERSONAL_ACCESS_TOKEN ghcr.io/github/github-mcp-server
+claude mcp add github -e 'GITHUB_PERSONAL_ACCESS_TOKEN=${GITHUB_PAT}' -- docker run -i --rm -e GITHUB_PERSONAL_ACCESS_TOKEN ghcr.io/github/github-mcp-server
  1. Restart Claude Code
  2. Run claude mcp list to see if the GitHub server is configured
    @@ -112,7 +114,7 @@

With an environment variable:

-claude mcp add --transport http github https://api.githubcopilot.com/mcp -H "Authorization: Bearer $(grep GITHUB_PAT .env | cut -d '=' -f2)"
+claude mcp add --transport http github https://api.githubcopilot.com/mcp -H 'Authorization: Bearer ${GITHUB_PAT}'
Windows (PowerShell)

@@ -120,8 +122,7 @@
If you see missing required argument 'name', put the server name immediately after claude mcp add:

-$pat = "YOUR_GITHUB_PAT"
-claude mcp add github --transport http https://api.githubcopilot.com/mcp/ -H "Authorization: Bearer $pat"
+claude mcp add github --transport http https://api.githubcopilot.com/mcp/ -H 'Authorization: Bearer ${GITHUB_PAT}'


The placeholder variants (`YOUR_GITHUB_PAT`) are left as they are. I can open this as a pull request if that is easier to review.
Lingua principale
Go
Stelle
34.2k
Fork
5.3k
Merge medio
5g 18h
PR unite (30g)
13

Preparare l'ambiente

Come iniziare

  1. Leggi tutta la issue e poi la guida ai contributi del progetto.
  2. Commenta sulla issue per dire che te ne occupi tu — evita che due persone facciano lo stesso lavoro.
  3. Fai un fork del repository e lavora su un branch.
  4. Apri una pull request che faccia riferimento al numero della issue.

Altre issue di github/github-mcp-server

Tutte le issue di github/github-mcp-server

Issue simili

Altre issue su Go

Ricevi le nuove issue nella tua casella

Un breve riepilogo di issue GitHub adatte ai principianti.