Configuration describes a connection, not a secret
MCP configuration should record server, transport, scope, auth boundary, and available operations. Real tokens and passwords must not enter the repository, diff, logs, or teaching examples.
Credentials should come from the environment or a secret manager, while the configuration remains reviewable.
workflow-kit/
└── .claude/
└── mcp/
└── issue-tracker.jsonTransport can be local or remote
| Transport | How it works | Typical case |
|---|---|---|
| stdio | Claude launches a local process through standard streams | Script or local utility |
| http | Claude calls an already running server over the network | Team tracker, docs, or monitoring |
{"name":"docs-local","transport":"stdio","command":"python","args":["scripts/docs_server.py"]}
{"name":"issue-tracker","transport":"http","endpoint":"${ISSUE_TRACKER_URL}"}Configuration scope and auth scope differ
- user — a server for several personal projects;
- local — an uncommitted experiment;
- project — a shared repository workflow;
- plugin — capability delivered with a package.
| Concept | Question answered |
|---|---|
| Config scope | Who sees settings and where they are stored? |
| Auth scope | Which operations can the token or account perform? |
Status check and recovery
- Inspect the configured server and transport.
- Confirm that credentials are resolved outside source files.
- List available tools without invoking writes.
- Check the smallest read-only request.
- Record errors, scope, and fallback.
- Disable or remove the server when its boundary is unclear.
Canonical lesson source · JavaRush
Open JavaRush material