A team's .mcp.json, committed to the repository, configures a GitHub MCP server with an engineer's personal access token written directly in the file. What is the best fix?

Answer: C — Replace the literal token with ${GITHUB_TOKEN} and have each engineer set that variable

Environment variable expansion in .mcp.json keeps the shared configuration in the repository while each environment supplies its own secret (c). Gitignoring the file (a) or moving the server to user scope (b) keeps the token out of git but gives up the shared team configuration. A token as a tool parameter (d) puts the credential in model-visible calls.