How to Pass .env API Keys to mcp_config.json Without Hardcoding Secrets

Open your local mcp_config.json or Claude Desktop config file right now. If you configured a GitHub, Brave Search, Postgres, or Slack MCP server, chances are high you have raw, plaintext API tokens hardcoded directly into the JSON body:

The core problem: the standard JSON specification does not support dynamic variable substitution. Typing "GITHUB_TOKEN": "$GITHUB_TOKEN" will literally pass the string "$GITHUB_TOKEN" to the MCP server, causing authorization failures (HTTP 401 Unauthorized).

Here are the 3 verified production patterns to inject environment variables securely from a local .env file into your MCP servers without committing secrets to source control.

Pattern 1: The dotenv-cli Wrapper (Recommended for Windows 11)

The cleanest cross-platform method to load an external .env file into an MCP subprocess without relying on native shell features is using dotenv-cli.

Instead of invoking the MCP server directly, you invoke dotenv-cli via npx, point it to your secret file (e.g. $HOME/.env or a project-specific .env.local), and append your target command.dotenv-cli parses the file, injects the variables into process.env, and spawns the MCP server with full credentials:

// Command executed under the hood:
npx -y dotenv-cli -e ~/.env -- npx -y @modelcontextprotocol/server-github

Pattern 2: The Shell Sourcing Wrapper (macOS, Linux & WSL2)

If you run on macOS, Ubuntu, or inside WSL2, you can use bash's native parameter expansion by passing a single command string through bash -c.

By running set -a && source /path/to/.env && set +a, all variables declared inside your .env file are automatically exported to the subprocess environment before the MCP server starts:

// macOS / Linux Command:
bash -c "source $HOME/.env && npx -y @modelcontextprotocol/server-github"

Cross-Platform Config Snippets

Copy the exact JSON block for your operating system below:

{
  "mcpServers": {
    "github": {
      "command": "cmd",
      "args": [
        "/c",
        "npx",
        "-y",
        "dotenv-cli",
        "-e",
        "C:\\Users\\Developer\\.env",
        "--",
        "npx",
        "-y",
        "@modelcontextprotocol/server-github"
      ],
      "env": {}
    }
  }
}

{
  "mcpServers": {
    "github": {
      "command": "wsl.exe",
      "args": [
        "bash",
        "-c",
        "set -a && source /home/developer/.env && set +a && npx -y @modelcontextprotocol/server-github"
      ],
      "env": {}
    }
  }
}

{
  "mcpServers": {
    "github": {
      "command": "bash",
      "args": [
        "-c",
        "source $HOME/.env && npx -y @modelcontextprotocol/server-github"
      ],
      "env": {}
    }
  }
}

Pattern 3: Native IDE Environment Inheritance

In Google Antigravity IDE, child processes inherit the environment variables of the active shell session from which the IDE was launched.

If you launch your agentic IDE from your terminal:

# In your ~/.zshrc or ~/.bashrc:
export GITHUB_PERSONAL_ACCESS_TOKEN="ghp_xxx"
export BRAVE_API_KEY="bsa_xxx"

# Launch IDE from terminal:
agy .

You can leave the "env" block empty inside mcp_config.json:

{
  "mcpServers": {
    "github": {
      "command": "npx",
      "args": ["-y", "@modelcontextprotocol/server-github"],
      "env": {}  // Automatically inherits from parent shell session
    }
  }
}

Benchmark: Secret Exposure Risk vs. Launch Overhead

We measured token security and startup overhead across 4 credential injection methods on our testbed:

Security Checklist for MCP Configuration

• Never commit mcp_config.json if it contains raw alphanumeric tokens.
• Add .env, .env.local, and *.key to your global ~/.gitignore file.
• Use dotenv-cli for Windows 11 systems where native bash sourcing is unavailable.
• Run git status to confirm your secret files are ignored before executing git commits.