The list of credential/secret-like environment variables blanked when expanding ${VAR} references in MCP server configs has grown substantially, covering OAuth refresh tokens, proxy settings (HTTPS_PROXY, HTTP_PROXY, ALL_PROXY), package registry tokens (NPM_TOKEN, CARGO_REGISTRY_TOKEN, PYPI_TOKEN, TWINE_PASSWORD, CODEARTIFACT_AUTH_TOKEN), pip/uv index URLs, Go proxy vars, and cloud/identity tokens. A warning is now logged whenever such a variable would have been forwarded to a remote server.
Names in the bundleHTTPS_PROXY
The entry above is what we published on the day. These lines were added later, as Anthropic's own pages caught up, and they sit beside the original rather than replacing it.
Confirmed since
Anthropic's documentation has since written up HTTPS_PROXY, on Use Claude Science on a corporate network.
Sign-in fails with this message when the proxy demands credentials the app is not sending, because the proxy address carries none or the proxy was detected from the macOS or Windows system settings, which never supply credentials. Include …claude-science/corporate-networks see the edit
One source agreesOne thing we can check says the same as this entry.
Anthropic's documentation agrees
Anthropic's documentation has since written up HTTPS_PROXY, on Use Claude Science on a corporate network.