What
When Claude Code displays or logs an MCP server's configuration, sensitive parts are now masked first. For servers connected over HTTP or SSE, headers are replaced with [REDACTED]. For servers run as local processes (stdio), environment variable values are replaced with [REDACTED] and command-line arguments are cleared. The server's URL or command itself also goes through a separate masking step. This applies to the mcp status, mcp list, and mcp get commands, as well as configuration diffs.
Why
MCP server configs often carry secrets like API keys or tokens in headers or environment variables. Redacting them before display prevents those secrets from being accidentally exposed on screen or in logs.