PRODUCTION SCENARIO
A transit agency runs a remote route-data MCP server used by six repositories. Every contributor, including outside ones, should pick the server definition up from the repository they clone, and each supplies their own ROUTE_API_TOKEN, which must stay out of version control. The agency issues no laptops and manages none of the machines its contributors work on.
Where should the server definition live?
Answering here is anonymous. Nothing is saved unless you sign in.
Show answer and explanation
Answer: A .mcp.json committed at each repository root, its headers reading ${ROUTE_API_TOKEN}
Project scope is the one that ships with the repository: a .mcp.json at the root is meant to be checked into version control so every contributor gets the same server, and variable expansion in headers keeps the credential itself out of the file. The name matters, because Claude Code reads a fixed set of credential variables as empty toward a remote server while a project-specific name expands normally. A user-scoped entry is right for a personal server you want across your own projects, and local scope for an experimental one in a single checkout; neither travels with a clone. Managed configuration is how an administrator pushes a server to a fleet, and this agency manages no machines.
Official Source: https://code.claude.com/docs/en/mcp ↗