Claude Code .mcp.json: why ${ANTHROPIC_API_KEY} reads empty for Sume

If a ${...} reference in a remote server's url or headers names one of Claude Code's covered credential variables, it expands to an empty string, so Authorization: Bearer ${NPM_TOKEN} sent to Sume would carry no key. Claude Code's MCP page lists the covered names and says a name outside that set expands as written. Store the Sume key in a variable you name yourself, for example SUME_API_KEY.

Source: Connect Claude Code to tools via MCP, read 2026-10-02, together with Sume's MCP OAuth and API keys.

Which variables does Claude Code treat as credentials?

The page names three groups: Claude Code's own credentials such as ANTHROPIC_API_KEY and ANTHROPIC_AUTH_TOKEN; cloud provider credentials such as AWS_BEARER_TOKEN_BEDROCK; and other credentials your environment carries, such as HTTPS_PROXY and NPM_TOKEN. A covered name reads as empty whether or not you set it, and a :-default fallback on it is ignored. A provider base URL such as ANTHROPIC_BASE_URL still expands.

What does the Sume entry look like?

Sume accepts Authorization: Bearer <key> or x-api-key: <key> on hosted MCP. In .mcp.json, reference your own variable, so the file can be committed with no secret in it.

{
  "mcpServers": {
    "sume": {
      "type": "http",
      "url": "https://mcp.sume.com/mcp",
      "headers": {
        "Authorization": "Bearer ${SUME_API_KEY}"
      }
    }
  }
}

How do I tell the value is empty?

The page says a server that receives Bearer with no credential rejects the request, usually with a 401, and Claude Code reports that as a failed connection. When a remote entry references a covered variable you have set, Claude Code names it in a debug-log line. Run claude --debug-file /tmp/claude-debug.log and search the file for never expanded toward a remote server.

What if my key already lives in a covered variable?

Copy it into a name of your own, as the page advises, and reference that name. Do not reuse ANTHROPIC_API_KEY for a Sume key: they are different credentials. Create Sume keys in the dashboard and keep one per environment.