A key written into env
"env": { "GITHUB_PERSONAL_ACCESS_TOKEN": "ghp_…" } keeps the key as plain text in a file in your user folder. Common, and worth moving.
AI coding agents · Claude Desktop
Which MCP servers Claude Desktop starts, and what they can reach
Every server in claude_desktop_config.json starts when the app launches and runs with your user account's permissions. Claude asks before it uses a tool; the server itself is already running.
claude_desktop_config.json −key in the file+key from Keychain−"command": "npx", "args": ["-y", "example-mcp-server"],−"env": { "EXAMPLE_API_KEY": "sk-••••••" }+"command": "/Users/you/bin/example-mcp"
Where Claude Desktop keeps its MCP servers
Claude › Settings › Developer › Edit Config opens the file. Quit the app completely after you edit it.
| Scope | File | What's in it |
|---|---|---|
| Local servers | ~/Library/Application Support/Claude/claude_desktop_config.json (macOS)%APPDATA%\Claude\claude_desktop_config.json (Windows)~/.config/Claude/claude_desktop_config.json (Linux) | mcpServers: each with command, args and env. |
| Desktop extensions | Settings › Extensions | One-click .mcpb servers; fields marked sensitive go to your OS keychain. |
| Remote connectors | Customize › Connectors | Reached from Anthropic's cloud, not from your computer. |
| Admin policy | com.anthropic.claudefordesktop (macOS)HKLM:\SOFTWARE\Policies\Claude (Windows) | Can switch local MCP servers and extensions off. |
Six things to check
A key in args or an address
"--token", "…" in args, ?api_key= in a URL, or user:pass@host.
A launcher with no exact version
npx -y some-mcp-server runs whatever the registry serves that day. Pin @1.2.3.
A bare command name
"command": "npx" runs whatever comes first on PATH. The MCP docs suggest an absolute path.
A command that downloads and runs code
bash -c "curl … | sh", node -e "…", or a script under /tmp.
Wide folders for the filesystem server
@modelcontextprotocol/server-filesystem with /Users/you or /: Claude can read and change everything there.
Keep the key in your keychain
Claude Desktop's docs don't describe ${VAR} in this file, so start the server from a small script instead (macOS; store the key once with security add-generic-password -a "$USER" -s EXAMPLE_API_KEY -w).
{
"mcpServers": {
"example": { "command": "/Users/you/bin/example-mcp" }
}
}
# /Users/you/bin/example-mcp (chmod +x)
#!/bin/sh
EXAMPLE_API_KEY="$(/usr/bin/security find-generic-password -s EXAMPLE_API_KEY -w)" || exit 1
export EXAMPLE_API_KEY
exec npx -y example-mcp-server@1.2.3 The key leaves the plain-text config for the login Keychain, the config starts one program by its full path, and the package version is fixed. If the server comes as a desktop extension, installing that keeps sensitive fields in the keychain with no script.
Or check all of it at once
For Claude Desktop, NeuroShield reads claude_desktop_config.json: keys in env, args and URLs, unpinned packages, bare commands, downloads and known risky servers. Each server is a card you can switch off, with Undo.
Read only
It reads settings files and never runs your agents, their MCP servers or their scripts.
Nothing leaves this computer
The check runs locally. No account, no upload, no AI inside: fixed, published rules.
Nothing changes without your OK
Where a safe fix exists, Fix It for Me makes it after you confirm, with a backup and Undo.
Questions
Where is claude_desktop_config.json?
macOS ~/Library/Application Support/Claude/, Windows %APPDATA%\Claude\, Linux ~/.config/Claude/. Or Settings › Developer › Edit Config.
Is it safe to put an API key in env?
It works, and the official examples do it, but the key sits in that file as plain text.
Does an MCP server need my approval to touch my files?
Claude asks before it uses a server's tools. The server itself starts with the app and can do any file operation you can.
See your own agents
The check is free: how many agents you have and what they can do. Details and fixes come with Shields.