docs(install-claude): "environment variable" examples put the PAT in argv and the saved config #3758

Problem

Several Claude Code commands in docs/installation-guides/install-claude.md (and one in README.md) expand the personal access token in the shell before Claude Code runs, so the token ends up in the process argument list, in shell history, and as a literal value in the saved MCP configuration:

• install-claude.md, "With an environment variable (Linux/macOS)": "Bearer '"$GITHUB_PAT"'" closes the single quotes so the shell substitutes the token into the claude mcp add-json argument.
• install-claude.md, "With an environment variable (Windows PowerShell)": "Bearer $env:GITHUB_PAT" inside a double-quoted string, same effect.
• install-claude.md, Docker "With an environment variable": -e GITHUB_PERSONAL_ACCESS_TOKEN=$(grep GITHUB_PAT .env | cut -d '=' -f2).
• install-claude.md, legacy format: -H "Authorization: Bearer $(grep GITHUB_PAT .env | cut -d '=' -f2)", and the PowerShell variant $pat = "YOUR_GITHUB_PAT" followed by -H "Authorization: Bearer $pat".
• README.md, "Reference the token in configurations": -e GITHUB_PERSONAL_ACCESS_TOKEN=$GITHUB_PAT.

The sections are labelled "With an environment variable", but the stored configuration does not reference the variable; it holds the token itself.

Suggested fix

Claude Code expands ${VAR} references in an MCP server's url, headers, env, command, and args when it connects (Claude Code MCP docs, "Environment variable expansion"). Keeping the reference in single quotes stores ${GITHUB_PAT} literally, so the token stays in the environment and never reaches argv, history, or the config file. Minimal diff, against main at 99d6d65:

--- a/README.md
+++ b/README.md
@@ -226,8 +226,8 @@
 3. **Reference the token in configurations**
 
    ```bash
-   # CLI usage
-   claude mcp add github -e GITHUB_PERSONAL_ACCESS_TOKEN=$GITHUB_PAT -- docker run -i --rm -e GITHUB_PERSONAL_ACCESS_TOKEN ghcr.io/github/github-mcp-server
+   # CLI usage (single quotes: Claude Code expands ${GITHUB_PAT} at start-up, so the token stays out of argv and the saved config)
+   claude mcp add github -e 'GITHUB_PERSONAL_ACCESS_TOKEN=${GITHUB_PAT}' -- docker run -i --rm -e GITHUB_PERSONAL_ACCESS_TOKEN ghcr.io/github/github-mcp-server
 
    # In config files (where supported)
    "env": {
--- a/docs/installation-guides/install-claude.md
+++ b/docs/installation-guides/install-claude.md
@@ -40,14 +40,16 @@
 With an environment variable (Linux/macOS):
 ```bash
 export GITHUB_PAT="$(grep '^GITHUB_PAT=' .env | cut -d '=' -f2-)"
-claude mcp add-json github '{"type":"http","url":"https://api.githubcopilot.com/mcp","headers":{"Authorization":"Bearer '"$GITHUB_PAT"'"}}'
+claude mcp add-json github '{"type":"http","url":"https://api.githubcopilot.com/mcp","headers":{"Authorization":"Bearer ${GITHUB_PAT}"}}'

+The single quotes keep ${GITHUB_PAT} literal. Claude Code expands it from the environment when it connects, so the token stays out of the command line, shell history, and the saved configuration. Set GITHUB_PAT in the environment Claude Code starts from.
+
With an environment variable (Windows PowerShell):

$githubPatLine = Get-Content .env | Select-String "^\s*GITHUB_PAT\s*=" | Select-Object -First 1
$env:GITHUB_PAT = ($githubPatLine.Line -split "=", 2)[1].Trim().Trim('"').Trim("'")
-claude mcp add-json github "{`"type`":`"http`",`"url`":`"https://api.githubcopilot.com/mcp`",`"headers`":{`"Authorization`":`"Bearer $env:GITHUB_PAT`"}}"
+claude mcp add-json github '{"type":"http","url":"https://api.githubcopilot.com/mcp","headers":{"Authorization":"Bearer ${GITHUB_PAT}"}}'

About the --scope flag (optional): Use this to specify where the configuration is stored:
@@ -80,7 +82,7 @@

With an environment variable:

-claude mcp add github -e GITHUB_PERSONAL_ACCESS_TOKEN=$(grep GITHUB_PAT .env | cut -d '=' -f2) -- docker run -i --rm -e GITHUB_PERSONAL_ACCESS_TOKEN ghcr.io/github/github-mcp-server
+claude mcp add github -e 'GITHUB_PERSONAL_ACCESS_TOKEN=${GITHUB_PAT}' -- docker run -i --rm -e GITHUB_PERSONAL_ACCESS_TOKEN ghcr.io/github/github-mcp-server

2. Restart Claude Code
3. Run claude mcp list to see if the GitHub server is configured
   @@ -112,7 +114,7 @@

With an environment variable:

-claude mcp add --transport http github https://api.githubcopilot.com/mcp -H "Authorization: Bearer $(grep GITHUB_PAT .env | cut -d '=' -f2)"
+claude mcp add --transport http github https://api.githubcopilot.com/mcp -H 'Authorization: Bearer ${GITHUB_PAT}'

Windows (PowerShell)

@@ -120,8 +122,7 @@
If you see missing required argument 'name', put the server name immediately after claude mcp add:

-$pat = "YOUR_GITHUB_PAT"
-claude mcp add github --transport http https://api.githubcopilot.com/mcp/ -H "Authorization: Bearer $pat"
+claude mcp add github --transport http https://api.githubcopilot.com/mcp/ -H 'Authorization: Bearer ${GITHUB_PAT}'

The placeholder variants (`YOUR_GITHUB_PAT`) are left as they are. I can open this as a pull request if that is easier to review.