Playing around with MCP in #vscode and one of the things that struck me is the usage of .env files to store tokens. The guidance from #enthropic is to at least make this "secure" by adding the .env file to your .gitignore file, but I'd rather not do that either.
Way too easy for any process to capture that file and exfiltrate it.
So I set out to update the @github MCP Server with support for the GitHub CLI. Now when I chat to github using Visual Studio Code,
I can simply rely on the token stored in the Windows Credential Store for added safety.
Did a pull request, lets see if this will land.
Don't think this will easily be supported by the docker version of the MCP servers, since it won't have access to the Windows Credential Store.
Then again, running docker in visual studio code on windows on wsl is still not the best experience int he world.
If you'd like to try this yourself, clone this PR, build the GitHub MCP server locally and update your vscode insiders settings to the following:
```
"mcp": {
"github": {
"command": "node",
"args": ["node", "E:\\mcp-servers\\src\\github\\dist\\index.js" ],
"env": { "GITHUB_PERSONAL_ACCESS_TOKEN_USE_GHCLI": "true" } } } }
```
https://github.com/modelcontextprotocol/servers/pull/1239