Is it safe to commit .mcp.json? (API keys in MCP configs)
Yes, as long as it doesn't contain secrets. Claude Code expands ${VAR} and ${VAR:-default} in .mcp.json, so reference keys from the environment instead of pasting them. Anyone who clones the repo can read the file.
Stats from the 2026-10-20 snapshot of public GitHub configs (methodology). Behavior checked against the official docs linked below.
Use environment variables
{
"mcpServers": {
"github": {
"command": "npx",
"args": [
"-y",
"@modelcontextprotocol/server-github"
],
"env": {
"GITHUB_PERSONAL_ACCESS_TOKEN": "${GITHUB_TOKEN}"
}
},
"api": {
"type": "http",
"url": "https://api.example.com/mcp",
"headers": {
"Authorization": "Bearer ${API_KEY}"
}
}
}
}Syntax differs by tool
Claude Code's .mcp.json uses ${VAR} or ${VAR:-default}, expanded in command, args, env, url and headers. Cursor's .cursor/mcp.json uses ${env:VAR}. In Claude Code, a remote server entry needs "type": "http", and credential variables such as ANTHROPIC_API_KEY read as empty in a remote server's url and headers, so use a variable name of your own.
What public configs do
22 of 1,150 unique public .mcp.json files (1.9%) and 112 of 1,427 .cursor/mcp.json files (7.8%) contain at least one credential-looking value. The detector is a heuristic and has false positives.
If you already committed a key
Rotate it with the provider first. Removing it from the file doesn't remove it from git history.
FAQ
Should .mcp.json be in .gitignore?
Not necessarily. Sharing it lets the team use the same servers. Gitignore it only if it has to hold machine-specific values.