Cowork sessions don't inject user_config env vars into MCP server processes

[slavins-co]

Summary

MCP servers that use user_config in their manifest to receive credentials via environment variables don't get those values in cowork sessions. The env vars are completely absent (not even unresolved template strings).

Reproduction

1. Install an MCP extension with user_config fields (e.g., cellartracker-mcp)
2. Configure credentials via the Claude Desktop extension settings UI
3. Verify credentials work in normal Desktop mode (tools succeed)
4. Start a cowork session
5. Call any tool that requires credentials - fails with "credentials not found"

Expected behavior

user_config values from extension settings JSON are resolved and injected as env vars into the MCP server process, same as in normal Desktop mode.

Actual behavior

Env vars are completely absent. Diagnostic output from inside the cowork VM:

CT_USERNAME=(not set)
CT_PASSWORD=(not set)
HOME=/sessions/zealous-affectionate-ritchie

The extension settings on the host are populated correctly:

~/Library/Application Support/Claude/Claude Extensions Settings/local.mcpb.brad-slavin.cellartracker-mcp.json

Contains valid userConfig with both ct_username and ct_password.

Manifest configuration

The extension's manifest.json declares:

"server": {
  "mcp_config": {
    "env": {
      "CT_USERNAME": "${user_config.ct_username}",
      "CT_PASSWORD": "${user_config.ct_password}"
    }
  }
},
"user_config": {
  "ct_username": { "type": "string", "required": true },
  "ct_password": { "type": "string", "required": true, "sensitive": true }
}

This works correctly in normal Desktop mode. Only cowork sessions fail to resolve these templates.

Impact

Any MCP extension relying on user_config for authentication is broken in cowork sessions. Users must re-enter credentials via tooling at the start of every session, and those credentials are lost when the ephemeral VM session ends.

Workaround

Running setup-credentials (an MCP tool) at the start of each cowork session temporarily fixes it for that session, but credentials are lost when the session ends since the VM filesystem is ephemeral.

Environment

• macOS 15.5 (Darwin 25.3.0)
• Claude Desktop (latest as of 2026-03-25)
• cellartracker-mcp v0.3.1

[github-actions]

Found 3 possible duplicate issues:

1. [BUG] 'env' vars from .claude/settings.json not passed to the plugins/mcps. #11927
2. [BUG] MCP stdio servers fail when they depend on env vars from .mcp.json (meta-ads-mcp) #38381
3. [BUG] MCP servers start before settings.local.json env vars are applied (race condition) #36161

This issue will be automatically closed as a duplicate in 3 days.

• If your issue is a duplicate, please close it and 👍 the existing issue instead
• To prevent auto-closure, add a comment or 👎 this comment

🤖 Generated with Claude Code

[slavins-co]

Not a duplicate — cowork-specific env var propagation gap

The three flagged issues are related but describe different execution contexts:

• [BUG] 'env' vars from .claude/settings.json not passed to the plugins/mcps. #11927 — env vars from .claude/settings.json not passed to plugin MCPs (Claude Code CLI)
• [BUG] MCP stdio servers fail when they depend on env vars from .mcp.json (meta-ads-mcp) #38381 — env block in .mcp.json not passed to stdio MCP child processes (local spawning)
• [BUG] MCP servers start before settings.local.json env vars are applied (race condition) #36161 — MCP servers start before settings.local.json env vars are applied (startup race condition)

All three are about env var handling in local Claude Code/Desktop sessions. This issue is about cowork sessions where the MCP server runs inside an ephemeral VM and user_config values from the host's extension settings are never injected at all.

Diagnostic evidence from inside the cowork VM:

• CT_USERNAME and CT_PASSWORD are completely absent (not even unresolved ${user_config.*} template strings)
• The VM has 62 env vars total (normal environment, not stripped)
• HOME is /sessions/<random-name> (ephemeral, resets each session)
• Extension settings JSON exists on the host with valid credentials, but the VM never receives them

Precedent for this class of bug: #23561 fixed the same pattern in a different context — agent teammates spawned via tmux on Bedrock/Vertex/Foundry weren't receiving API provider env vars until a specific propagation fix was added. This suggests env var forwarding is handled per-execution-context, and cowork VMs need their own fix for user_config resolution and injection.

This is the same category of bug (env vars not propagating to MCP child processes) but a different code path (cowork VM orchestration vs. local stdio spawning).

[Tanguy-la-moule]

Hello, any idea when this will be fixed? We're eager to have Metabase in Cowork 👍

[aaronepinto-multiply]

bump

[brotherdust]

bump

[rbonestell]

This issue has also blocked my Claude Cowork plugin development. Commenting to ensure this issue doesn't get auto-closed.