Question 1 · choose 1
Your team wants every developer who clones the repository to get the same GitHub MCP server in Claude Code. The server needs a personal access token in an Authorization header, and tokens must never be committed. How should the server be configured?
- ACommit .mcp.json with a shared service-account token so that nobody has to set anything up
- BHave each developer add the server with claude mcp add --scope user, passing their own token on the command line
- CDescribe the server's URL and the token setup in the project CLAUDE.md so that Claude connects to it
- DCommit it in the project's .mcp.json with the Authorization header set to "Bearer ${GITHUB_TOKEN}"
Show the answer and why
ACommit .mcp.json with a shared service-account token so that nobody has to set anything up
Incorrect
This puts a secret in version control, which the requirement rules out.
BHave each developer add the server with claude mcp add --scope user, passing their own token on the command line
Incorrect
User scope is private to each machine, so the shared configuration drifts and new teammates do not get it from the repository.
CDescribe the server's URL and the token setup in the project CLAUDE.md so that Claude connects to it
Incorrect
CLAUDE.md gives Claude instructions; it does not configure MCP servers.
DCommit it in the project's .mcp.json with the Authorization header set to "Bearer ${GITHUB_TOKEN}"
Correct
Project-scoped .mcp.json is shared through version control, and environment variable expansion keeps each developer's token out of the file.
Shared team tooling belongs in project-scoped .mcp.json, and credentials stay out of it through ${VAR} expansion in fields such as headers, which Claude Code fills from each developer's environment.
Anthropic documentation