Servers That Need API Keys

Module 2 · Section 10 of 10

Servers That Need API Keys

The filesystem server needs no credentials — it just talks to your local machine. Most servers that connect to external services need credentials. The pattern looks like this, for something like a GitHub server:

"github": {
  "command": "npx",
  "args": ["-y", "@modelcontextprotocol/server-github"],
  "env": {
    "GITHUB_PERSONAL_ACCESS_TOKEN": "your-token-here"
  }
}

The token goes in env, not in the args array. Never put credentials in the args — they can show up in process listings. The env approach keeps them out of that exposure surface.

---

You’ve got a working MCP server. Module 3 looks at which servers are worth installing and how to evaluate ones you find in the wild.