Local MCP servers inherit OPENCODE_SERVER_PASSWORD #52427

Description

When opencode serve runs with OPENCODE_SERVER_PASSWORD (and optionally OPENCODE_SERVER_USERNAME) set, every local (type: "local") MCP server it starts receives both variables in its environment.

connectLocal in packages/opencode/src/mcp/index.ts (v1.18.32, 545f51d) builds the server's environment as:

env: {
  ...process.env,
  ...(cmd === "opencode" ? { BUN_BE_BUN: "1" } : {}),
  ...mcp.environment,
},

So any MCP server, including a third-party one from npm, can read the Basic Auth credential and call the opencode HTTP API with full access: send prompts, answer permission requests, read sessions. The password exists to keep other local processes out of the server, and the MCP server is exactly such a process.

Steps to reproduce

1. Configure a local MCP server whose command prints its environment, for example ["sh", "-c", "env > /tmp/mcp-env; cat"].
2. Run OPENCODE_SERVER_PASSWORD=secret opencode serve.
3. Open a session so the MCP server starts.
4. /tmp/mcp-env contains OPENCODE_SERVER_PASSWORD=secret.

Observed on opencode 1.18.32, macOS.

Expected

The server's own credentials are not passed to child processes it starts for tools. Removing OPENCODE_SERVER_PASSWORD and OPENCODE_SERVER_USERNAME from the inherited environment before mcp.environment is applied would keep an explicit per-server setting possible. The same likely applies to other children started with ...process.env (LSP servers, formatters, shell tools); those may deserve the same treatment.

A fork already does this: Kilo Code strips KILO_SERVER_PASSWORD and KILO_SERVER_USERNAME in packages/*/src/kilocode/process/env.ts.