anomalyco/opencode
1
0
Fork 0
mirror of https://github.com/anomalyco/opencode.git synced 2026-07-22 02:05:26 -04:00
Code Issues 5.9k Packages Projects Releases 19 Wiki Activity

{env:...} variable substitution inconsistently fails for specific MCP server URLs #3434

New Issue
Closed
opened 2026-02-16 17:40:04 -05:00 by yindo · 2 comments
yindo commented 2026-02-16 17:40:04 -05:00
Owner
Copy Link
Copy Source

Originally created by @fpdy on GitHub (Dec 9, 2025).

Originally assigned to: @rekram1-node on GitHub.

Summary

Environment variable substitution using {env:VAR_NAME} syntax works for some remote MCP servers but fails for others, even when using identical configuration patterns.

Environment

  • OS: macOS (darwin)
  • OpenCode version: Latest (installed via npm)
  • Shell: zsh
  • Config location: ~/.config/opencode/opencode.jsonc

Steps to Reproduce

  1. Configure two remote MCP servers with the same {env:...} pattern in opencode.jsonc:
"mcp": {
  "exa": {
    "type": "remote",
    "url": "https://mcp.exa.ai/mcp?exaApiKey={env:EXA_API_KEY}",
    "enabled": true
  },
  "tavily": {
    "type": "remote",
    "url": "https://mcp.tavily.com/mcp?tavilyApiKey={env:TAVILY_API_KEY}",
    "enabled": true
  }
}
  1. Export both environment variables in ~/.zshrc:
export EXA_API_KEY=<valid-key>
export TAVILY_API_KEY=<valid-key>
  1. Start OpenCode from a terminal where both env vars are confirmed to be set.
  2. Invoke both MCP tools.

Expected Behavior

Both MCP servers should receive the API key and work correctly, since the configuration pattern is identical.

Actual Behavior

  • Exa MCP: Works correctly. API key is substituted and requests succeed.
  • Tavily MCP: Fails with {"error":"Search failed","detail":"API key is required"}.

Additional Testing

Test Result
Hardcoding API key directly in Tavily URL ✅ Works
Using {env:TAVILY_API_KEY} in URL ❌ Fails
Using {env:EXA_API_KEY} in URL (Exa) ✅ Works
Renaming MCP server from "tavily" to "tavily-mcp" ❌ Still fails
Using headers with Authorization: Bearer {env:TAVILY_API_KEY} ❌ Fails
The environment variable values are confirmed identical between .zshrc and the hardcoded test.

Possible Cause

There may be an issue with how OpenCode caches or resolves {env:...} substitutions for specific MCP server names or URLs. The inconsistency between Exa (working) and Tavily (not working) with identical patterns suggests a bug in the variable substitution logic.

Workaround

Just hardcoding the API key directly in the URL works, but this is not ideal for security reasons.

OpenCode version

1.0.137

Steps to reproduce

No response

Screenshot and/or share link

No response

Operating System

No response

Terminal

No response

Originally created by @fpdy on GitHub (Dec 9, 2025). Originally assigned to: @rekram1-node on GitHub. ## Summary Environment variable substitution using `{env:VAR_NAME}` syntax works for some remote MCP servers but fails for others, even when using identical configuration patterns. ## Environment - **OS**: macOS (darwin) - **OpenCode version**: Latest (installed via npm) - **Shell**: zsh - **Config location**: `~/.config/opencode/opencode.jsonc` ## Steps to Reproduce 1. Configure two remote MCP servers with the same `{env:...}` pattern in `opencode.jsonc`: ``` "mcp": { "exa": { "type": "remote", "url": "https://mcp.exa.ai/mcp?exaApiKey={env:EXA_API_KEY}", "enabled": true }, "tavily": { "type": "remote", "url": "https://mcp.tavily.com/mcp?tavilyApiKey={env:TAVILY_API_KEY}", "enabled": true } } ``` 2. Export both environment variables in ~/.zshrc: ```shell export EXA_API_KEY=<valid-key> export TAVILY_API_KEY=<valid-key> ``` 3. Start OpenCode from a terminal where both env vars are confirmed to be set. 4. Invoke both MCP tools. ## Expected Behavior Both MCP servers should receive the API key and work correctly, since the configuration pattern is identical. ## Actual Behavior - Exa MCP: Works correctly. API key is substituted and requests succeed. - Tavily MCP: Fails with {"error":"Search failed","detail":"API key is required"}. ## Additional Testing | Test | Result | |------|--------| | Hardcoding API key directly in Tavily URL | ✅ Works | | Using {env:TAVILY_API_KEY} in URL | ❌ Fails | | Using {env:EXA_API_KEY} in URL (Exa) | ✅ Works | | Renaming MCP server from "tavily" to "tavily-mcp" | ❌ Still fails | | Using headers with Authorization: Bearer {env:TAVILY_API_KEY} | ❌ Fails | The environment variable values are confirmed identical between `.zshrc` and the hardcoded test. ## Possible Cause There may be an issue with how OpenCode caches or resolves {env:...} substitutions for specific MCP server names or URLs. The inconsistency between Exa (working) and Tavily (not working) with identical patterns suggests a bug in the variable substitution logic. ## Workaround Just hardcoding the API key directly in the URL works, but this is not ideal for security reasons. ### OpenCode version 1.0.137 ### Steps to reproduce _No response_ ### Screenshot and/or share link _No response_ ### Operating System _No response_ ### Terminal _No response_
yindo added the bug label 2026-02-16 17:40:04 -05:00
yindo closed this issue 2026-02-16 17:40:04 -05:00
yindo commented 2026-02-16 17:40:04 -05:00
Author
Owner
Copy Link
Copy Source

@github-actions[bot] commented on GitHub (Dec 9, 2025):

This issue might be a duplicate of existing issues. Please check:

  • #231: add ability to load secrets from external command or environment variables in the config file
  • #318: feature: Ability to pass credentials without storing in environment file

Both of these issues relate to environment variable substitution in MCP server configurations, though they focus more on the feature request side. Your issue describes a specific bug where {env:...} works for some servers but not others.

Additionally, you may want to check #5278 (z.ai MCPs stopped working at 1.0.137) to see if there are any related environment variable loading issues introduced in recent versions.

Feel free to ignore if these don't match your specific case.

@github-actions[bot] commented on GitHub (Dec 9, 2025): This issue might be a duplicate of existing issues. Please check: - #231: add ability to load secrets from external command or environment variables in the config file - #318: feature: Ability to pass credentials without storing in environment file Both of these issues relate to environment variable substitution in MCP server configurations, though they focus more on the feature request side. Your issue describes a specific bug where {env:...} works for some servers but not others. Additionally, you may want to check #5278 (z.ai MCPs stopped working at 1.0.137) to see if there are any related environment variable loading issues introduced in recent versions. Feel free to ignore if these don't match your specific case.
yindo commented 2026-02-16 17:40:04 -05:00
Author
Owner
Copy Link
Copy Source

@rekram1-node commented on GitHub (Dec 10, 2025):

@fpdy if you do:

opencode debug config

are the urls populating correctly?

@rekram1-node commented on GitHub (Dec 10, 2025): @fpdy if you do: opencode debug config are the urls populating correctly?
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
acp
bad
bug
discussion
docs
documentation
enhancement
extension
good first issue
growth
help-wanted
mcp
model-problem
needs:compliance
nix
opentui
perf
pull-request
Mirrored from GitHub Pull Request
 tui
web
windows
zen
No Label bug
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
yindo
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: anomalyco/opencode#3434
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?