MCP (Model Context Protocol) servers configuration. These values are written to the world-readable Nix store, so avoid putting secrets in env, headers, args, or url. For a local command server that takes a secret through an environment variable, you can use programs.mcp.servers with env.<NAME>.file = "/run/secrets/..." and enable both programs.mcp.enable and programs.claude-code.enableMcpIntegration. Home Manager then wraps the command so it reads the file at startup. This covers environment variables of local servers, not credentials in arguments, URLs, or headers.

{ }

{ customTransport = { customOption = "value"; timeout = 5000; type = "websocket"; url = "wss://example.com/mcp"; }; database = { args = [ "-y" "@bytebase/dbhub" "--dsn" "postgresql://localhost:5432/db" ]; command = "npx"; type = "stdio"; }; filesystem = { args = [ "-y" "@modelcontextprotocol/server-filesystem" "/tmp" ]; command = "npx"; type = "stdio"; }; github = { type = "http"; url = "https://api.githubcopilot.com/mcp/"; }; }