[BUG] headersHelper silently ignoring env vars with SECRET in the name

Preflight Checklist

• [x] I have searched existing issues and this hasn't been reported yet
• [x] This is a single bug report (please file separate reports for different bugs)
• [x] I am using the latest version of Claude Code

What's Wrong?

In recent Claude code versions, headersHelper silently strips environment variables containing "SECRET" in their name i.e

{
  "mcpServers": {
    "auth-repro": {
      "type": "http",
     "url": "<mcp server url>",
 "headersHelper": "CLIENT_ID=${CLIENT_ID} CLIENT_SECRET=${CLIENT_SECRET} bash ./headers-helper.sh"
    }
}

CLIENT_SECRET gets ignored or unset. NOTE: the ${CLIENT_SECRET} is what gets ignored. Setting CLIENT_SECRET to ${CLIENT_FOO} is not an issue (assuming CLIENT_FOO is set)

What Should Happen?

headersHelper scripts should receive the full environment (or at minimum, all variables explicitly referenced in the headersHelper command string), including variables with SECRET in their name. Since a common use case for headersHelper is generating the auth headers, it should be completely normal and expected to pass in secret variables.

Error Messages/Logs

The script silently fails and it falls back to auth and attempts DCR registration

Steps to Reproduce

1. Export env var with SECRET in the name:

export CLIENT_SECRET=SECRET

1. Configure a headers-helper.sh script like so:

#!/bin/bash
# headersHelper script — outputs JSON headers to stdout
echo "{\"Authorization\": \"$CLIENT_SECRET\"}"

1. Create the .mcp.json

{
  "mcpServers": {
    "my-mcp-server": {
      "type": "http",
     "url": "<mcp server url>",
 "headersHelper": "CLIENT_SECRET=${CLIENT_SECRET} bash <path to headers-helper.sh>"
    }
  }
}

1. Then open Claude, connect to the MCP server
2. Observe: connecting to the MCP fails auth

Now, export CLIENT_FOO=SECRET and update .mcp.json to

{
  "mcpServers": {
    "my-mcp-server": {
      "type": "http",
     "url": "<mcp server url>",
 "headersHelper": "CLIENT_SECRET=${CLIENT_FOO} bash <path to headers-helper.sh>"
    }
  }
}

And it should connect.

Claude Model

Sonnet (default)

Is this a regression?

Yes, this worked in a previous version

Last Working Version

Unknown, but likely stopped working in the releases last 2 weeks or so

Claude Code Version

2.1.274

Platform

Anthropic API

Operating System

macOS

Terminal/Shell

Terminal.app (macOS)

Additional Information

This seems to be a recent issue that has been getting reported the last 1-2 weeks or so.