MCP env vars: tokens stripped from OPENAPI_MCP_HEADERS, NOTION_TOKEN renamed to NOTION_API_KEY (v2.1.109)

Description

Starting with Claude Code 2.1.109, MCP server environment variables containing tokens are being modified before being passed to the child process. This breaks authentication for the official Notion MCP server.

Observed behavior

When configuring the Notion MCP server with either approach from the official README:

Option 1: NOTION_TOKEN

{
  "mcpServers": {
    "notion": {
      "command": "npx",
      "args": ["-y", "@notionhq/notion-mcp-server"],
      "env": { "NOTION_TOKEN": "ntn_****" }
    }
  }
}

Option 2: OPENAPI_MCP_HEADERS

{
  "mcpServers": {
    "notion": {
      "command": "npx",
      "args": ["-y", "@notionhq/notion-mcp-server"],
      "env": {
        "OPENAPI_MCP_HEADERS": "{\"Authorization\": \"Bearer ntn_****\", \"Notion-Version\": \"2022-06-28\"}"
      }
    }
  }
}

The MCP server process receives modified env vars:

| Config env var | What process actually receives |
|---|---|
| NOTION_TOKEN=ntn_** | NOTION_API_KEY=ntn_ (renamed!) |
| OPENAPI_MCP_HEADERS={"Authorization": "Bearer ntn_**", ...} | OPENAPI_MCP_HEADERS={"Authorization": "Bearer ", ...} (token stripped!) |

The Notion MCP server reads NOTION_TOKEN (not NOTION_API_KEY) and OPENAPI_MCP_HEADERS (expects the token present). Since neither contains the correct token, every API call returns HTTP 401.

Steps to reproduce

1. Configure the Notion MCP server in .claude.json using either method above
2. Restart Claude Code
3. Use any Notion MCP tool (e.g., get-self)
4. Observe 401 unauthorized

Verification

The token is valid - direct curl to https://api.notion.com/v1/users/me returns HTTP 200. Inspecting the running MCP server process via ps eww confirms the env vars are modified before reaching the process.

Additional observations

• Claude Code also overrides the command and args for servers named "notion", always using npm exec @notionhq/notion-mcp-server regardless of config
• This was working in the previous Claude Code version (pre-2.1.109)
• Renaming the server avoids the command override but not the env var stripping

Workaround

Use a wrapper script that reads the token from a file at runtime:

#!/bin/bash
export NOTION_TOKEN="$(cat ~/.claude/.notion-token)"
unset OPENAPI_MCP_HEADERS
exec npx -y @notionhq/notion-mcp-server "$@"

Environment

• Claude Code: 2.1.109
• OS: macOS (Darwin 25.4.0)
• Notion MCP Server: 2.2.1 (@notionhq/notion-mcp-server)