PRODUCTION SCENARIO
A team wants every engineer's Claude Code session to connect to the same internal HTTP MCP server. The server needs a bearer token, and the token must never be committed to the repository.
How should the server be configured?
Answering here is anonymous. Nothing is saved unless you sign in.
Show answer and explanation
Answer: Project scope in .mcp.json, with the token written as ${API_KEY} in the headers
Project scope stores the server in .mcp.json, which is shared through version control, and Claude Code expands ${VAR} references from the environment at load time so the token stays out of the file. Local and user scope are stored per machine in ~/.claude.json and are not shared with the team.
Official Source: https://code.claude.com/docs/en/mcp ↗