MCP server env secret placeholders are not passed to spawned process

[nathbooth]

Describe the bug

On macOS, a secret configured for a stdio MCP server using Copilot CLI's ${secret:...} placeholder does not appear to reach the spawned server process.

The same server works when the credential is provided as a normal process environment variable. When launched by Copilot CLI using the secret placeholder, authentication fails because the server behaves as if the environment variable is unset.

Affected version

GitHub Copilot CLI 1.0.88.

Steps to reproduce the behavior

No response

Expected behavior

1. Store a test credential using Copilot CLI's MCP secret mechanism.
2. Configure a stdio MCP server with an environment entry like "API_TOKEN": "${secret:example-mcp/env/API_TOKEN/v}".
3. Start the MCP server through Copilot CLI and call a tool that checks whether API_TOKEN is set.
4. Start the same server outside Copilot CLI with API_TOKEN set directly in its process environment.

Actual behaviour

The server launched by Copilot CLI behaves as if API_TOKEN is missing. The same server works when API_TOKEN is set directly in the process environment.

Additional context

• OS: macOS 26.5 (25F71)
• Server transport: stdio
• The secret was present in the configured secret store.
• The issue persisted after refreshing the secret and restarting Copilot CLI.
• The report intentionally excludes the server implementation, service
  endpoints, secret values, and internal configuration paths.

[nathbooth]

Minimal reproduction

Reproduced on Copilot CLI 1.0.88, macOS, stdio transport. The finding is slightly more specific than the original report: the env var is not unset. The ${secret:...} placeholder is passed to the spawned process verbatim, unexpanded, so the server ends up authenticating with the literal placeholder string.

Three stdio servers were registered that differ only in how API_TOKEN is set. Each one logs the value it receives at startup:

env.API_TOKEN in mcp-config.json	Value the spawned server process received
${secret:example-mcp/env/API_TOKEN/v}	${secret:example-mcp/env/API_TOKEN/v} (literal, 37 chars)
${REPRO_PARENT_TOKEN} (set in the launching shell)	parent-env-value-xyz (expanded correctly)
literal-value-123	literal-value-123

Raw server log from one run:

started pid=37949 API_TOKEN="${secret:example-mcp/env/API_TOKEN/v}" argv=["secret-variant"]
started pid=37948 API_TOKEN="parent-env-value-xyz" argv=["plainvar-variant"]
started pid=37947 API_TOKEN="literal-value-123" argv=["literal-variant"]

So plain ${VAR} expansion from the parent environment works, but the secret: form is not resolved. copilot mcp get <name> --show-secrets also shows the placeholder string, not a resolved value.

Steps

1. Save the two files below into a directory.
2. Run ./repro.sh. It registers the three servers with copilot mcp add, runs copilot -p once with --allow-all-tools so the agent calls check_env on each server, then prints what each spawned process saw.
3. Clean up with for n in env-check-secret env-check-plainvar env-check-literal; do copilot mcp remove $n; done.

server.mjs (dependency-free stdio MCP server exposing a check_env tool)

#!/usr/bin/env node
// Minimal stdio MCP server, no dependencies. Exposes one tool: check_env.
// Reports whether API_TOKEN is set in this process's environment.
import { createInterface } from 'node:readline';
import { writeFileSync, appendFileSync } from 'node:fs';

const LOG = process.env.REPRO_LOG || '/tmp/repro-4985-server.log';
const tok = process.env.API_TOKEN;
appendFileSync(LOG, `[${new Date().toISOString()}] started pid=${process.pid} API_TOKEN=${tok === undefined ? '<UNSET>' : JSON.stringify(tok)} argv=${JSON.stringify(process.argv.slice(2))}\n`);

function report() {
  return {
    API_TOKEN_set: tok !== undefined,
    API_TOKEN_length: tok === undefined ? 0 : tok.length,
    API_TOKEN_looks_like_placeholder: tok !== undefined && tok.includes('${secret:'),
    API_TOKEN_value_if_short: tok !== undefined && tok.length <= 40 ? tok : undefined,
    other_env_keys_containing_TOKEN: Object.keys(process.env).filter(k => /TOKEN/i.test(k)),
  };
}

const send = (msg) => process.stdout.write(JSON.stringify(msg) + '\n');
const rl = createInterface({ input: process.stdin });
rl.on('line', (line) => {
  if (!line.trim()) return;
  let req; try { req = JSON.parse(line); } catch { return; }
  appendFileSync(LOG, `  <- ${req.method}\n`);
  const { id, method, params } = req;
  if (method === 'initialize') {
    send({ jsonrpc: '2.0', id, result: {
      protocolVersion: params?.protocolVersion || '2024-11-05',
      capabilities: { tools: {} },
      serverInfo: { name: 'env-check', version: '0.0.1' } } });
  } else if (method === 'tools/list') {
    send({ jsonrpc: '2.0', id, result: { tools: [{
      name: 'check_env',
      description: 'Reports whether the API_TOKEN environment variable is set in the MCP server process.',
      inputSchema: { type: 'object', properties: {}, additionalProperties: false } }] } });
  } else if (method === 'tools/call') {
    const r = report();
    appendFileSync(LOG, `  tools/call check_env -> ${JSON.stringify(r)}\n`);
    send({ jsonrpc: '2.0', id, result: { content: [{ type: 'text', text: JSON.stringify(r, null, 2) }] } });
  } else if (method === 'ping') {
    send({ jsonrpc: '2.0', id, result: {} });
  } else if (id !== undefined) {
    send({ jsonrpc: '2.0', id, error: { code: -32601, message: `Method not found: ${method}` } });
  }
});

repro.sh

#!/usr/bin/env bash
# Repro for https://github.com/github/copilot-cli/issues/4985
# Registers three stdio MCP servers that differ only in how API_TOKEN is set,
# runs Copilot CLI once, and prints what each spawned server actually received.
set -euo pipefail
D="$(cd "$(dirname "$0")" && pwd)"; LOG="$D/server.log"; : > "$LOG"
for n in env-check-secret env-check-plainvar env-check-literal; do copilot mcp remove "$n" >/dev/null 2>&1 || true; done
copilot mcp add env-check-secret   --env 'API_TOKEN=${secret:example-mcp/env/API_TOKEN/v}' --env "REPRO_LOG=$LOG" -- node "$D/server.mjs" secret-variant   >/dev/null
copilot mcp add env-check-plainvar --env 'API_TOKEN=${REPRO_PARENT_TOKEN}'                  --env "REPRO_LOG=$LOG" -- node "$D/server.mjs" plainvar-variant >/dev/null
copilot mcp add env-check-literal  --env 'API_TOKEN=literal-value-123'                      --env "REPRO_LOG=$LOG" -- node "$D/server.mjs" literal-variant  >/dev/null
export REPRO_PARENT_TOKEN=parent-env-value-xyz
copilot -p "Call the check_env tool on each of the MCP servers env-check-secret, env-check-plainvar and env-check-literal, then reply with the word done." --allow-all-tools -s >/dev/null
echo "=== What each spawned server saw for API_TOKEN ==="; grep started "$LOG"
echo; echo "Cleanup: for n in env-check-secret env-check-plainvar env-check-literal; do copilot mcp remove \$n; done"