Keep the Claude t3-code MCP bearer out of process arguments

Claude's built-in t3-code MCP credential is passed in process arguments through the Agent SDK.

In ClaudeAdapter.ts at the inspected commit, the query options put mcpSession.authorizationHeader under mcpServers["t3-code"].headers.Authorization. The installed Agent SDK serializes those options into the CLI arguments as --mcp-config followed by inline JSON containing mcpServers.

The resulting thread-scoped bearer can therefore enter process listings, command-line diagnostics and monitoring logs. The normal Linux /proc access rules still apply. This report does not imply that an unrelated user can always read it, or that it is an administrative T3 bearer.

To reproduce without exposing a credential in a report:

1. Start a Claude thread with the built-in T3 MCP enabled.
2. Locally inspect the argument following --mcp-config, without copying its value into logs or an issue.
3. Check whether it contains the t3-code HTTP server's Authorization header.

Please consider writing this MCP configuration to a private file and passing its path to the CLI instead of putting the bearer into query options that the SDK serializes inline. The file should be created atomically with owner-only access, live outside shared workspaces, and be removed on session cleanup. A regression test can assert that spawned arguments contain no bearer and that the private file contains the intended server configuration.

On a shared remote backend, restricting /proc visibility is a useful interim measure. A private config file reduces accidental argument/log exposure; it does not isolate processes running under the same operating-system user.

Start with apps/server/src/provider/Layers/ClaudeAdapter.ts at the inspected commit and reproduce the --mcp-config argument behavior locally without logging credentials. Trace how the t3-code server configuration reaches the spawned CLI, then add or locate a regression test that checks spawned arguments contain no bearer and the private configuration contains the intended server settings.