docs(install-claude): "environment variable" examples put the PAT in argv and the saved config

Aberta Para iniciantes
  • Algo errado?
#3,758 0 comentários 0 reações 0 responsáveis Ver no GitHub

Mantenedores costumam responder em até 2 dias

Ninguém assumiu esta issue ainda.

Avaliação

Dificuldade
2/5
Tempo estimado
1-3 horas
Facilidade para iniciantes
82/100
Tipo de issue
Documentação
Clareza
Claramente especificada
Status de atividade
Ativa
Stack de tecnologia
markdown
Domínio
documentation, security

Direção de pesquisa

Comece pelos exemplos de comandos em docs/installation-guides/install-claude.md e pelo exemplo de configuração do token em README.md; compare como cada um passa o PAT para o Claude Code. Consulte a documentação de expansão de variáveis de ambiente do Claude Code citada pela issue para confirmar a sintaxe compatível. O trabalho estará concluído quando todos os exemplos de variáveis de ambiente listados mantiverem uma referência a uma variável na configuração salva e não expandirem mais o PAT nos argumentos do comando.

Escrita pelo modelo de indexação a partir do texto da issue.

Descrição

Problem

Several Claude Code commands in docs/installation-guides/install-claude.md (and one in README.md) expand the personal access token in the shell before Claude Code runs, so the token ends up in the process argument list, in shell history, and as a literal value in the saved MCP configuration:

  • install-claude.md, "With an environment variable (Linux/macOS)": "Bearer '"$GITHUB_PAT"'" closes the single quotes so the shell substitutes the token into the claude mcp add-json argument.
  • install-claude.md, "With an environment variable (Windows PowerShell)": "Bearer $env:GITHUB_PAT" inside a double-quoted string, same effect.
  • install-claude.md, Docker "With an environment variable": -e GITHUB_PERSONAL_ACCESS_TOKEN=$(grep GITHUB_PAT .env | cut -d '=' -f2).
  • install-claude.md, legacy format: -H "Authorization: Bearer $(grep GITHUB_PAT .env | cut -d '=' -f2)", and the PowerShell variant $pat = "YOUR_GITHUB_PAT" followed by -H "Authorization: Bearer $pat".
  • README.md, "Reference the token in configurations": -e GITHUB_PERSONAL_ACCESS_TOKEN=$GITHUB_PAT.

The sections are labelled "With an environment variable", but the stored configuration does not reference the variable; it holds the token itself.

Suggested fix

Claude Code expands ${VAR} references in an MCP server's url, headers, env, command, and args when it connects (Claude Code MCP docs, "Environment variable expansion"). Keeping the reference in single quotes stores ${GITHUB_PAT} literally, so the token stays in the environment and never reaches argv, history, or the config file. Minimal diff, against main at 99d6d6503a7b2a133e2f8a595d6d0ba24b4086d3:

--- a/README.md
+++ b/README.md
@@ -226,8 +226,8 @@
 3. **Reference the token in configurations**
 
    ```bash
-   # CLI usage
-   claude mcp add github -e GITHUB_PERSONAL_ACCESS_TOKEN=$GITHUB_PAT -- docker run -i --rm -e GITHUB_PERSONAL_ACCESS_TOKEN ghcr.io/github/github-mcp-server
+   # CLI usage (single quotes: Claude Code expands ${GITHUB_PAT} at start-up, so the token stays out of argv and the saved config)
+   claude mcp add github -e 'GITHUB_PERSONAL_ACCESS_TOKEN=${GITHUB_PAT}' -- docker run -i --rm -e GITHUB_PERSONAL_ACCESS_TOKEN ghcr.io/github/github-mcp-server
 
    # In config files (where supported)
    "env": {
--- a/docs/installation-guides/install-claude.md
+++ b/docs/installation-guides/install-claude.md
@@ -40,14 +40,16 @@
 With an environment variable (Linux/macOS):
 ```bash
 export GITHUB_PAT="$(grep '^GITHUB_PAT=' .env | cut -d '=' -f2-)"
-claude mcp add-json github '{"type":"http","url":"https://api.githubcopilot.com/mcp","headers":{"Authorization":"Bearer '"$GITHUB_PAT"'"}}'
+claude mcp add-json github '{"type":"http","url":"https://api.githubcopilot.com/mcp","headers":{"Authorization":"Bearer ${GITHUB_PAT}"}}'

+The single quotes keep ${GITHUB_PAT} literal. Claude Code expands it from the environment when it connects, so the token stays out of the command line, shell history, and the saved configuration. Set GITHUB_PAT in the environment Claude Code starts from.
+
With an environment variable (Windows PowerShell):

$githubPatLine = Get-Content .env | Select-String "^\s*GITHUB_PAT\s*=" | Select-Object -First 1
$env:GITHUB_PAT = ($githubPatLine.Line -split "=", 2)[1].Trim().Trim('"').Trim("'")
-claude mcp add-json github "{`"type`":`"http`",`"url`":`"https://api.githubcopilot.com/mcp`",`"headers`":{`"Authorization`":`"Bearer $env:GITHUB_PAT`"}}"
+claude mcp add-json github '{"type":"http","url":"https://api.githubcopilot.com/mcp","headers":{"Authorization":"Bearer ${GITHUB_PAT}"}}'

About the --scope flag (optional): Use this to specify where the configuration is stored:
@@ -80,7 +82,7 @@

With an environment variable:

-claude mcp add github -e GITHUB_PERSONAL_ACCESS_TOKEN=$(grep GITHUB_PAT .env | cut -d '=' -f2) -- docker run -i --rm -e GITHUB_PERSONAL_ACCESS_TOKEN ghcr.io/github/github-mcp-server
+claude mcp add github -e 'GITHUB_PERSONAL_ACCESS_TOKEN=${GITHUB_PAT}' -- docker run -i --rm -e GITHUB_PERSONAL_ACCESS_TOKEN ghcr.io/github/github-mcp-server
  1. Restart Claude Code
  2. Run claude mcp list to see if the GitHub server is configured
    @@ -112,7 +114,7 @@

With an environment variable:

-claude mcp add --transport http github https://api.githubcopilot.com/mcp -H "Authorization: Bearer $(grep GITHUB_PAT .env | cut -d '=' -f2)"
+claude mcp add --transport http github https://api.githubcopilot.com/mcp -H 'Authorization: Bearer ${GITHUB_PAT}'
Windows (PowerShell)

@@ -120,8 +122,7 @@
If you see missing required argument 'name', put the server name immediately after claude mcp add:

-$pat = "YOUR_GITHUB_PAT"
-claude mcp add github --transport http https://api.githubcopilot.com/mcp/ -H "Authorization: Bearer $pat"
+claude mcp add github --transport http https://api.githubcopilot.com/mcp/ -H 'Authorization: Bearer ${GITHUB_PAT}'


The placeholder variants (`YOUR_GITHUB_PAT`) are left as they are. I can open this as a pull request if that is easier to review.
Linguagem predominante
Go
Estrelas
34.2k
Forks
5.3k
Merge médio
5d 18h
PRs com merge (30d)
13

Preparar o ambiente

Primeiros passos

  1. Leia a issue inteira e depois o guia de contribuição do projeto.
  2. Comente na issue dizendo que vai assumir — evita que duas pessoas façam o mesmo trabalho.
  3. Faça um fork do repositório e trabalhe em uma branch.
  4. Abra um pull request que referencie o número da issue.

Mais de github/github-mcp-server

Todas as issues de github/github-mcp-server

Issues semelhantes

Mais issues de Go

Receba novas issues na sua caixa de entrada

Um resumo curto de issues do GitHub para quem está começando.