Configuration describes a connection, not a secret

MCP configuration should record server, transport, scope, auth boundary, and available operations. Real tokens and passwords must not enter the repository, diff, logs, or teaching examples.

Credentials should come from the environment or a secret manager, while the configuration remains reviewable.

Project-scoped configuration location
workflow-kit/
└── .claude/
    └── mcp/
        └── issue-tracker.json

Transport can be local or remote

TransportHow it worksTypical case
stdioClaude launches a local process through standard streamsScript or local utility
httpClaude calls an already running server over the networkTeam tracker, docs, or monitoring
Schematic transport examples
{"name":"docs-local","transport":"stdio","command":"python","args":["scripts/docs_server.py"]}

{"name":"issue-tracker","transport":"http","endpoint":"${ISSUE_TRACKER_URL}"}

Configuration scope and auth scope differ

  • user — a server for several personal projects;
  • local — an uncommitted experiment;
  • project — a shared repository workflow;
  • plugin — capability delivered with a package.
ConceptQuestion answered
Config scopeWho sees settings and where they are stored?
Auth scopeWhich operations can the token or account perform?

Status check and recovery

  1. Inspect the configured server and transport.
  2. Confirm that credentials are resolved outside source files.
  3. List available tools without invoking writes.
  4. Check the smallest read-only request.
  5. Record errors, scope, and fallback.
  6. Disable or remove the server when its boundary is unclear.

Canonical lesson source · JavaRush

Open JavaRush material