🧾 JSONmedium
2. Pass a secret via env
The "github" stdio server needs an API token. Add an `env` map to it that sets "GITHUB_TOKEN". (A stdio server gets its secrets from environment variables — never over the protocol.)
How to approach this
Local stdio servers are trusted subprocesses, so they DON'T run OAuth — they receive credentials as ENVIRONMENT VARIABLES. In the config you add an `env` object to the server entry; the host injects those variables into the process. Keep real secrets out of source control (hosts usually allow ${VAR} expansion), but the SHAPE is a plain string→string map. Here the GitHub server reads GITHUB_TOKEN from its environment.
config.json