bcquality/custom/knowledge/mcp/mcp-config-must-not-hardcode-developer-paths.md
Michael Dieringer dd5637b1db Custom-laget bestaar nu begge CI-checks: 72 validator-fejl -> 0
Normalisering af alle 39 custom knowledge-filer til READ-kontraktens
skema (validate_frontmatter.py + Test-KnowledgeIndex.ps1 begge groenne):

- R01/R02: 28 filer manglede frontmatter eller brugte aeldre skemaer
  (title/category/severity/rule-id m.fl.) - alle har nu praecis de 6
  kraevede noegler; keywords haandskrevet pr. fil da de driver
  worklist-selektionen i INDEX/knowledge-index
- R09: manglende Description-sektion - regel-agtige foersteoverskrifter
  (Core Rule/Rule/Regel/Core Principle) omdoebt, eller sektion indsat
  efter titlen hvor intro-tekst fandtes
- R10: fenced code blocks konverteret til 4-space indrykkede blokke
  i alle filer (indhold uaendret)
- R11: 4 filer over 100 linjer fortaettet redaktionelt uden semantisk
  tab (ai-eval-scores 143->100, git-lifecycle 121->97,
  permission-sets 113->99, test-feature-scenario-tags 105->91)
- R05: AL0197->al0197, add_repo->add-repo; keyword-lister trimmet
  til maks 10

Ingen regler er fjernet eller aendret i betydning - kun form.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
2026-07-01 23:47:31 +02:00

2.4 KiB

bc-version domain keywords technologies countries application-area
all
mcp
mcp-config
hardcoded-paths
userprofile
portability
al
w1
all

Shared MCP configuration must not hardcode developer-specific paths

Description

A git-committed .mcp.json must not hardcode an absolute path that is specific to one developer's machine — a repository clone location on a particular drive or folder, or a home-directory path containing a specific username. Any such path must be resolved via Claude Code's built-in environment-variable expansion instead.

Why

.mcp.json is shared and committed — every developer who clones the repository inherits the exact same file. A path baked in for the machine of whoever wrote the file (e.g. C:\Curabis\ProjectX\... or C:\Users\<username>\.claude\bridge.js) works only for that one person. Every other developer's MCP servers silently fail to start, and the failure looks like a runtime problem rather than a configuration one — wasting time in the wrong place (see mcp-server-must-be-verified-at-session-start.md, which detects the symptom but not this root cause).

How to fix

Claude Code expands two forms of variable inside .mcp.json's command, args, env, url, and headers fields:

  • ${VAR} — any OS environment variable, e.g. ${USERPROFILE} on Windows resolves to the current user's home directory.
  • ${CLAUDE_PROJECT_DIR:-default} — the project root directory that Claude Code itself sets when it spawns a stdio MCP server. The :-default fallback is required because the variable is only available in the spawned process's environment, not at config-parse time.

Example:

{
  "mcpServers": {
    "example": {
      "command": "powershell",
      "args": ["-File", "${CLAUDE_PROJECT_DIR:-.}\\.vscode\\launch-server.ps1"]
    },
    "bridge": {
      "command": "node",
      "args": ["${USERPROFILE}\\.claude\\bridge.js"]
    }
  }
}

What NOT to do

  • Do not hardcode a drive letter + folder path that reflects one developer's clone location.
  • Do not hardcode C:\Users\<name>\... — every developer has a different username.
  • Do not "fix it locally" by editing the committed file to match your own machine — that only moves the breakage to the next developer who pulls.

Applies to

All CURABIS projects that configure MCP servers in .mcp.json.