Claude Code's .mcp.json expansion passes bare $VAR and unset ${VAR} to servers as raw text

The author of the dev.to post said that instead of guessing, they wrote a dependency-free stdio MCP server that reports its own process.argv and process.env, wired it into a .mcp.json several times over, and let Claude Code launch it ^[14]. The server answers initialize, ping, tools/list and tools/call over newline-delimited JSON-RPC and exposes one tool, echo_env ^[10]. At startup it appends a snapshot to spawn-log.jsonl, so a record of what the process received exists even when no model turn happens ^[11]. The run used a fresh mktemp -d directory, with no project instructions or memory files in play ^[12].

The config registers that one script seven times ^[13]. One entry carries all six forms in args and again as env keys. The other six differ only in command, because command is a single string and holds one form at a time ^[13]. Writing seven registrations is tedious, and it is the right call: each value is read back from the process itself, and the spawn log does not wait for a model to decide to call echo_env ^[11].

The docs list only the braced forms and do not mention $VAR without braces, or nesting ^[9]. In the test, an env key set to "$PROBE_SET" reached the server as the text $PROBE_SET ^[18][17]. The same happened in every other field, on the stdio entries and the HTTP one ^[4][1]. The server still launches, holding a variable's name where its value should be ^[17].

The unset case matched the docs ^[5][8]. The placeholder is a non-empty string. A server that only checks whether its token variable exists will find one, so the failure moves to whichever request first uses the token. I would not expect a rejected API call inside the server to send anyone to claude mcp list looking for that warning.

The author attributes the headers-only nesting result to headers being expanded twice ^[6]. On that account, the first pass would apply the outer default and leave ${PROBE_SET} in the string, and the second pass would resolve it ^[6].

Every result here comes from Claude Code 2.1.278 ^[2]. For these results to hold on another install, that install needs the same expander. The two braced forms, the five fields and the unset behavior are written into the docs ^[7][8]. The bare and nested results are observations of one release, and a later release could change either one without contradicting the page ^[9].