mcp.json
A configuration file for MCP clients, used to define the launch command, arguments and environment variables of MCP servers.
Timeline (last 90 days)
The path parameter for configuring an MCP server in mcp.json must use an absolute path, because the working directory of a subprocess launched via stdio may drift, causing relative paths to fail.
The MCP configuration files differ by AI tool: Cursor writes to mcp.json, VS Code writes to mcp.json in the user directory, Windsurf uses mcp.config.json, Codex uses config.toml, and Gemini CLI uses settings.json.
In Cursor's mcp.json, each server entry usually contains three key fields: command, args, and env, which respectively specify the program to execute, the arguments passed to the program, and the environment variables injected into the child process.
It is recommended to put the GitHub token in the env block of the mcp.json entry rather than in the args parameter, because content in args may be recorded in command logs, process lists, or debug output, whereas environment variables are relatively isolated.
mcp.json is a local configuration file in which the token is stored in plaintext; if the .cursor directory is to be placed under version control or synced to the cloud, this file must first be added to the ignore list.
Moving the GitHub token out of mcp.json and instead referencing a system environment variable in the launch command or storing it in the operating system keychain to be injected by a script can reduce the risk of plaintext tokens.
All Facts (6)
The path parameter for configuring an MCP server in mcp.json must use an absolute path, because the working directory of a subprocess launched via stdio may drift, causing relative paths to fail.
50%UnverifiedThe MCP configuration files differ by AI tool: Cursor writes to mcp.json, VS Code writes to mcp.json in the user directory, Windsurf uses mcp.config.json, Codex uses config.toml, and Gemini CLI uses settings.json.
50%UnverifiedIn Cursor's mcp.json, each server entry usually contains three key fields: command, args, and env, which respectively specify the program to execute, the arguments passed to the program, and the environment variables injected into the child process.
50%UnverifiedIt is recommended to put the GitHub token in the env block of the mcp.json entry rather than in the args parameter, because content in args may be recorded in command logs, process lists, or debug output, whereas environment variables are relatively isolated.
50%Unverifiedmcp.json is a local configuration file in which the token is stored in plaintext; if the .cursor directory is to be placed under version control or synced to the cloud, this file must first be added to the ignore list.
50%UnverifiedMoving the GitHub token out of mcp.json and instead referencing a system environment variable in the launch command or storing it in the operating system keychain to be injected by a script can reduce the risk of plaintext tokens.
50%