Description
CloudCLI loads user-scoped MCP server definitions from ~/.claude.json and passes the resulting object to the Claude Agent SDK as sdkOptions.mcpServers.
The SDK serializes that object into a --mcp-config <json> child-process argument. If an MCP server configuration contains credentials in its env or headers, those credentials become visible in ps and in /proc/<pid>/cmdline to other local users.
No credential values are included in this report.
Observed versions
- CloudCLI: 1.37.2
@anthropic-ai/claude-agent-sdk: 0.3.241- Linux
Relevant code path
claude-runtime.provider.js calls loadMcpConfig(options.cwd) and assigns the result to sdkOptions.mcpServers. The same SDK options already set settingSources to ['project', 'user', 'local'], so the Claude process can load user/project MCP configuration from its normal configuration sources without receiving a JSON literal on argv.
The installed SDK's process transport converts a non-empty mcpServers option into --mcp-config followed by serialized JSON.
Expected behavior
Secrets used by MCP servers should not appear in process arguments. CloudCLI should either:
- Let Claude load MCP configuration from the enabled settings sources without populating
sdkOptions.mcpServers, or
- Use a supported secure file/IPC mechanism if explicit SDK MCP injection is required.
An opt-out setting for explicit MCP injection would also provide a safe migration path.
Security impact
Any local account able to inspect the child process command line can read MCP credentials, even when the source configuration file is mode 0600. Process listings can also be copied into support logs or issue reports accidentally.
Suggested verification
Start a Claude chat with an MCP server whose configuration contains a sentinel environment variable. Confirm that the Claude child process has no inline --mcp-config JSON while the MCP tools remain available through normal settings-source discovery.
Description
CloudCLI loads user-scoped MCP server definitions from
~/.claude.jsonand passes the resulting object to the Claude Agent SDK assdkOptions.mcpServers.The SDK serializes that object into a
--mcp-config <json>child-process argument. If an MCP server configuration contains credentials in itsenvorheaders, those credentials become visible inpsand in/proc/<pid>/cmdlineto other local users.No credential values are included in this report.
Observed versions
@anthropic-ai/claude-agent-sdk: 0.3.241Relevant code path
claude-runtime.provider.jscallsloadMcpConfig(options.cwd)and assigns the result tosdkOptions.mcpServers. The same SDK options already setsettingSourcesto['project', 'user', 'local'], so the Claude process can load user/project MCP configuration from its normal configuration sources without receiving a JSON literal on argv.The installed SDK's process transport converts a non-empty
mcpServersoption into--mcp-configfollowed by serialized JSON.Expected behavior
Secrets used by MCP servers should not appear in process arguments. CloudCLI should either:
sdkOptions.mcpServers, orAn opt-out setting for explicit MCP injection would also provide a safe migration path.
Security impact
Any local account able to inspect the child process command line can read MCP credentials, even when the source configuration file is mode 0600. Process listings can also be copied into support logs or issue reports accidentally.
Suggested verification
Start a Claude chat with an MCP server whose configuration contains a sentinel environment variable. Confirm that the Claude child process has no inline
--mcp-configJSON while the MCP tools remain available through normal settings-source discovery.