[BUG] MCP server environment variable gets corrupted/redacted with bullet characters before reaching subprocess

Preflight Checklist

• [x] I have searched existing issues and this hasn't been reported yet
• [x] This is a single bug report (please file separate reports for different bugs)
• [x] I am using the latest version of Claude Code

What's Wrong?

configured a local MCP server (@modelcontextprotocol/server-github) via .mcp.json, referencing a token through env var substitution:

"env": {
"GITHUB_PERSONAL_ACCESS_TOKEN": "${GITHUB_PERSONAL_ACCESS_TOKEN}"
}

I set GITHUB_PERSONAL_ACCESS_TOKEN as a permanent Windows user environment variable via setx, confirmed success, and fully restarted Claude Code (also tried a full system reboot).

When the MCP server tool (list_issues etc.) is called, it fails with:

Cannot convert argument to a ByteString because the character at index 15 has a value of 8226 which is greater than 255.

Character code 8226 is U+2022, the bullet character (•). This suggests the actual token value being passed into the MCP server's environment has been replaced with a redacted/masked version (bullets in place of characters) rather than the real value — as if secret-redaction meant for display/logging is being applied to the literal runtime value passed to the child process.

This happened consistently across two separate attempts, including one where the token was typed directly into a fresh PowerShell window and never appeared in the chat transcript at all — ruling out clipboard/paste corruption on my end.

Environment: Windows 11, Claude Code desktop app, MCP server launched via npx -y @modelcontextprotocol/server-github.

Impact: Any MCP server relying on a real secret in its env config is broken — the redaction appears to corrupt the value before the subprocess ever sees it.

What Should Happen?

he MCP server subprocess should receive the actual value of the GITHUB_PERSONAL_ACCESS_TOKEN environment variable set via setx, unmodified, so it can authenticate to the GitHub API. Any secret-redaction Claude Code applies for display/logging purposes should only affect what's shown in the transcript/UI — it should never alter the literal value passed into a spawned MCP server's environment.

Error Messages/Logs

Steps to Reproduce

Cannot convert argument to a ByteString because the character at index 15 has a value of 8226 which is greater than 255.

Character code 8226 is U+2022, the bullet character (•). This suggests the actual token value being passed into the MCP server's environment has been replaced with a redacted/masked version (bullets in place of characters) rather than the real value — as if secret-redaction meant for display/logging is being applied to the literal runtime value passed to the child process.

This happened consistently across two separate attempts, including one where the token was typed directly into a fresh PowerShell window and never appeared in the chat transcript at all — ruling out clipboard/paste corruption on my end.

Claude Model

None

Is this a regression?

Yes, this worked in a previous version

Last Working Version

_No response_

Claude Code Version

1.30096.1

Platform

Anthropic API

Operating System

Windows

Terminal/Shell

Windows Terminal

Additional Information

_No response_