[Bug]: t3-code MCP bearer token is passed in argv and leaks to other processes and logs #18952

Before submitting

• I searched existing issues and did not find a duplicate.
• I included enough detail to reproduce or investigate the problem.

Area

apps/server

Steps to reproduce

1. Start a Claude thread in T3 Code (it gets the t3-code MCP server).
2. Look at the spawned process: ps -eo args | grep -- --mcp-config (or /proc/<pid>/cmdline).
3. The full MCP config is in argv, including the bearer credential:
   claude ... --mcp-config {"mcpServers":{"t3-code":{"url":"http://127.0.0.1:3773/mcp","headers":{"Authorization":"Bearer <token>"}}}}

Real-world consequence: a child tool started from the session recorded the full command line. adb (Android SDK platform-tools) wrote it, token included, three times into /tmp/adb.1000.log. Any tool that logs its parent's command line, plus anything that collects ps output (crash reporters, monitoring, diagnostics pasted into bug reports), can capture the token the same way.

Expected behavior

The credential never appears in a process's arguments. For example, write the MCP config to a per-session file readable only by the user (e.g. under $XDG_RUNTIME_DIR, mode 0600, removed when the session ends) and pass its path to --mcp-config, or pass the secret through an environment variable.

Actual behavior

The bearer token is in argv for the lifetime of the session. Every process of the same user can read it, and tools that log command lines persist it to disk.

Related: the server listens on 0.0.0.0:3773 by default, so a leaked token may be usable from the LAN or tailnet (depending on the firewall), not only from localhost.

Impact

Minor bug or occasional failure

Version or commit

0.0.45 (Omarchy package t3code 0.0.45-1)

Environment

Linux (Omarchy / Arch, Hyprland), Claude provider

Logs or stack traces

-tool stdio --resume=<id> --mcp-config {"mcpServers":{"t3-code":{"url":"http://127.0.0.1:3773/mcp","headers":{"Authorization":"Bearer <redacted>"

(excerpt from /tmp/adb.1000.log, token redacted)