mcp-invalid-env-var
Environment variables must use proper expansion syntax
Rule Details
This rule checks that environment variable references in MCP transport fields (command, args, url, headers, and env values) use proper ${VAR} expansion syntax and that variable names match a configurable naming pattern. It warns on empty env values, empty expansion syntax like ${}, variable names that do not match the expected pattern, and bare $VAR references that should use the ${VAR} format. The special variable ${CLAUDE_PLUGIN_ROOT} is always excluded from pattern validation.
Incorrect
Bare variable reference without braces
{
"mcpServers": {
"my-server": {
"command": "node",
"env": {
"API_KEY": "$MY_API_KEY"
}
}
}
}Empty environment variable value
{
"mcpServers": {
"my-server": {
"command": "node",
"env": {
"API_KEY": ""
}
}
}
}Correct
Proper variable expansion with braces
{
"mcpServers": {
"my-server": {
"command": "node",
"env": {
"API_KEY": "${MY_API_KEY}"
}
}
}
}How To Fix
Use the ${VAR_NAME} format for environment variable references. Ensure variable names match the expected pattern (default: uppercase letters, digits, and underscores starting with a letter or underscore). Provide non-empty values for all env entries.
Options
Default options:
{
"pattern": "^[A-Z_][A-Z0-9_]*$"
}Allow lowercase environment variable names:
{
"pattern": "^[a-zA-Z_][a-zA-Z0-9_]*$"
}Related Rules
Resources
Version
Available since: v0.2.0