An MCP server has to be enabled, startable, allowed and given its secret — cheat sheet

# the project's servers, and the files that can switch them off
cat .mcp.json
grep -rn 'McpjsonServers\|enableAllProjectMcpServers' .claude/ ~/.claude/settings.json 2>/dev/null
claude mcp list                         # config diagnostics (missing variables); untrusted: "pending"

# did this run's servers connect?
claude -p "hi" --output-format stream-json --verbose 2>/dev/null \
  | jq -c 'select(.type=="system" and .subtype=="init") | {mcp_servers, tools: [.tools[]|select(startswith("mcp"))]}'
claude -p "hi" --debug-file /tmp/claude-debug.log >/dev/null; grep 'MCP server' /tmp/claude-debug.log

# run the server's command by hand, with the job's environment
set -a; . ~/.config/support-digest/env; set +a
printf '%s\n' '{"jsonrpc":"2.0","id":1,"method":"tools/list"}' | python3 /opt/tickets/tickets_mcp.py

# names and permissions
#   tool list_tickets on server tickets  →  mcp__tickets__list_tickets
claude -p "…" --permission-mode dontAsk --allowedTools "mcp__tickets__list_tickets"
claude -p "…" --strict-mcp-config --mcp-config ci-mcp.json   # only these servers

# secrets: name the variable, never the value
"env": {"TICKETS_TOKEN": "${TICKETS_TOKEN}"}        # unset → passed literally
"env": {"LOG_LEVEL": "${LOG_LEVEL:-info}"}          # with a default

# a committed secret
git rm --cached .claude/settings.local.json && echo .claude/settings.local.json >> .gitignore
git grep -l "$TOKEN" $(git rev-list --all)          # still in history → rotate it