Shell substitution could place a GitHub PAT in arguments and saved Claude Code settings. Entry and authority. An operator follows the official installation command while a secret exists in the shell environment. Observed mechanism and consequence. Bash or PowerShell substituted credential values before handing JSON to claude mcp add-json, potentially…
Inspect the ClaimsCase · DiggingBeagle record
GitHub MCP install examples persisted expanded personal access tokens
Shell substitution could place a GitHub PAT in arguments and saved Claude Code settings.
Public disclosure: Nov 9, 2026
Scope
An operator follows the official installation command while a secret exists in the shell environment. Bash or PowerShell substituted credential values before handing JSON to claude mcp add-json, potentially persisting the value.
Assessment profile
Assessment method- Setting
- research demonstration
- Exploitation
- demonstrated
- Evidence
- Grade C
- Remediation
- mitigation available
- AI role
- AGAINST AI
Basis and provenance
Scoped Claim(s) link to SRC-2026-DB233-GITHUB-MCP-INSTALL-PAT; reviewed as vulnerability in research_demonstration. Only reported controlled behavior or proof-of-concept is established; no production victim or impact magnitude is measured.
Assessed Nov 10, 2026 using diggingbeagle.assessment/1.
Evidence basis: CLM-DB233-GITHUB-MCP-INSTALL-PAT-01 · github-mcp-server issue #3758
At a glance
No documented victim disclosure; exact exposure to history and process monitors depends on shell and environment.
Limits and uncertaintyFull account
Shell substitution could place a GitHub PAT in arguments and saved Claude Code settings.
Entry and authority. An operator follows the official installation command while a secret exists in the shell environment.
Observed mechanism and consequence. Bash or PowerShell substituted credential values before handing JSON to claude mcp add-json, potentially persisting the value.
Limits and status. No documented victim disclosure; exact exposure to history and process monitors depends on shell and environment.
The documented setup examples expanded a personal access token in a shell before serializing an MCP server configuration for Claude Code. Instead of a runtime environment reference, the resulting saved command could contain the literal credential, with additional exposure possible in process arguments. Exactly which history files record the token depends on the shell and command. The issue is about unsafe installation instructions rather than proof that GitHub MCP itself sent credentials to a third party.
Mechanism and trust boundary
- 01
Precondition and trust context
An operator follows the official installation command while a secret exists in the shell environment.
- 02
Crossed boundary
Bash or PowerShell substituted credential values before handing JSON to claude mcp add-json, potentially persisting the value.
- 03
Observed limit
No documented victim disclosure; exact exposure to history and process monitors depends on shell and environment.
Timeline
- Nov 9, 2026Event type unspecified
Initial documented finding
GitHub MCP install examples persisted expanded personal access tokens
- Nov 9, 2026disclosure
Public disclosure
Claims & evidence
CLM-DB233-GITHUB-MCP-INSTALL-PAT-01A repository issue reports: Bash or PowerShell substituted credential values before handing JSON to claude mcp add-json, potentially persisting the value.supported
Basis: reported finding
- supportsgithub-mcp-server issue #3758primary disclosure
Issue #3758, description and reproduction
Controls and mitigations
- Use runtime secret references rather than interpolating token values into command arguments and persisted MCP JSON.
- Review generated Claude Code configuration, process argument visibility, shell histories and already shared installation scripts for literal tokens.
Unknowns and contradictions
- No documented victim disclosure; exact exposure to history and process monitors depends on shell and environment.
Sources and citation
Material revision history
- Nov 10, 2026 · Published version · first publication · revision 235