Read GitHub PAT from env?

[tifandotme]

Storing an API key in a plain settings.json file can expose it if you push your config to a dotfiles repo (as I might). Could it instead be read from something like a shell environment variable?

[jeffreyguenther]

The extension can use the same environment as your local shell. Let me take look at making this change.

[JonGretar]

Yes I have the same issue.

Of course Zed really should allow for environment variables in their configuration json.
But that fix might be some moments away.

[jeffreyguenther]

I've reached out to the Zed team to find the best way to do this.

[goalves]

Unsure if useful but GitHub also has its gh cli which can be used to output the currently configured PAT token if the value is not set on env.

gh auth token

[erwindassen]

Bump on this... would be very useful

[jeffreyguenther]

I don't have control over this as Zed needs to implement it. I recommend asking on the Discord and providing this feedback to them. The last I heard, they were thinking about secrets more broadly. Now that the agent is out and the debugger is out, there might be bandwidth to dive into this.

I can ask again, but no promises.

[jeffreyguenther]

Took a pass at the extension docs today and now I'm not sure. My Rust isn't the strongest, but it seems like it might be possible.

@bennetbo do you have any guidance you can provide?

[jeffreyguenther]

Oops. I misread Bennet's response the last time I asked. Reading from a the env is possible. It was integrating with the platform keychain that's not currently possible.

Let me give this a try. I too would love to remove all the secrets in my settings.json.

Standby.

[olivoil]

It seems to output the access token in zed's log files in plain text as well. Could it be omitted or obfuscated?

// in `~/Library/Logs/Zed/Zed.log` on macOS

2025-06-30T11:09:03-05:00 INFO  [project::context_server_store::extension] loaded command for context server mcp-server-github: Command { command: "~/Library/Application Support/Zed/extensions/work/mcp-server-github/github-mcp-server-v0.5.0/github-mcp-server", args: ["stdio"], env: [("GITHUB_PERSONAL_ACCESS_TOKEN", "github_pat_<full_access_token_in_plain_text>")] }

[jfi]

Hey @jeffreyguenther, any update on this? 😊

[jfi]

I spent a bit of time on this today with some Googling and help from Claude; disclaimer: I'm a Rust newbie so a lot of the Rust code is Claude's.

Unless anybody can find anything to the contrary Zed's settings doesn't pick up external environment variables (due to running inside a WASM sandbox) and until it does the solution is to use a wrapper script that starts the MCP server outside of Zed.

#14 is the PR; interested in your feedback @jeffreyguenther as it's a relatively big change. :)

https://github.com/tastybamboo/zed-mcp-server-github is my fork; works for me, but if anyone else wants to test that'd be great.