{"version":"2.1.257","anchor":"much-larger-list-of-environment-variables-scrubbed-from-mcp","canonical_anchor":"much-larger-list-of-environment-variables-scrubbed-from-mcp","heading":"Much larger list of environment variables scrubbed from MCP config expansion","tier":"notice","area":"MCP","scope":null,"heads_up":null,"url":"https:\/\/changelogs.core-directive.com\/v\/2.1.257\/e\/much-larger-list-of-environment-variables-scrubbed-from-mcp","release_url":"https:\/\/changelogs.core-directive.com\/v\/2.1.257","markdown":"### Much larger list of environment variables scrubbed from MCP config expansion\n\nMany more credential-like variables, including proxy and registry tokens, are blanked when expanding MCP config references.\n\nThe list of credential\/secret-like environment variables blanked when expanding `${VAR}` references in MCP server configs has grown substantially, covering OAuth refresh tokens, proxy settings (`HTTPS_PROXY`, `HTTP_PROXY`, `ALL_PROXY`), package registry tokens (`NPM_TOKEN`, `CARGO_REGISTRY_TOKEN`, `PYPI_TOKEN`, `TWINE_PASSWORD`, `CODEARTIFACT_AUTH_TOKEN`), pip\/uv index URLs, Go proxy vars, and cloud\/identity tokens. A warning is now logged whenever such a variable would have been forwarded to a remote server.\n\n- Area: MCP\n- Names: `HTTPS_PROXY`\n- Tier: You'll notice\n- Useful: 2\/5\n- Signal: 2\/5"}