PRODUCTION SCENARIO
A team wants every engineer's Claude Code session to reach the same internal HTTP MCP server. The server needs a bearer token, and the token must never be committed to the repository.
How should the server be configured?
Answering here is anonymous. Nothing is saved unless you sign in.
Show answer and explanation
Answer: Project scope in .mcp.json, with ${API_KEY} in the Authorization header
Project scope stores the server in .mcp.json, which ships through version control, and Claude Code expands ${VAR} in the headers field at load time so the bearer token stays in each engineer's environment. User scope is stored per machine in ~/.claude.json and reaches nobody else. Local scope is also stored in ~/.claude.json under the project's path, not in .mcp.json as that option claims. An env block sets variables for a stdio server that Claude Code launches, so it never becomes a bearer header on a remote HTTP endpoint.
Official Source: https://code.claude.com/docs/en/mcp ↗