Skip to main content

prefer-environment-mcp-credentials

Disallow literal sensitive HTTP headers in Codex MCP configuration when environment-backed credentials are available.

Rule catalog ID: R015

Targeted pattern scope​

  • **/.codex/config.toml
  • standalone *.config.toml profiles where applicable

What this rule reports​

  • MCP server {{serverName}} stores sensitive header {{headerName}} as a literal. Use bearer_token_env_var or env_http_headers so credentials stay outside config.

Why this rule exists​

Disallow literal sensitive HTTP headers in Codex MCP configuration when environment-backed credentials are available.

❌ Incorrect​

A file in the targeted scope that produces any diagnostic listed above is incorrect for this rule.

✅ Correct​

A file is correct when it uses the documented Codex structure and produces no diagnostic from this rule.

Behavior and migration notes​

Included in:

  • codex.configs.strict
  • codex.configs.all

ESLint flat config example​

The preset layers supply the correct Markdown, TOML, or JSON language configuration. Override the rule only in a later matching flat-config entry:

import codex from "@typpi/eslint-plugin-codex";

export default [
 ...codex.configs.recommended,
 {
  rules: { "codex/prefer-environment-mcp-credentials": "error" },
 },
];

Further reading​