diff --git a/.env.example b/.env.example
index 1d71622..db139e2 100644
--- a/.env.example
+++ b/.env.example
@@ -23,17 +23,6 @@ OPENROUTER_API_KEY=
 # (Railway / Fly / Render). Defaults to 4096.
 PORT=
 
-# === Optional: MCP server credentials ===
-# Substituted into opencode-user-config.json via {env:VAR}. Leave empty to
-# skip a server — opencode will just fail to authenticate to that one.
-
-# Context7 (https://context7.com) — get from your Context7 dashboard.
-CONTEXT7_API_KEY=
-
-# GitHub MCP server — a GitHub Personal Access Token (classic or fine-grained)
-# with the scopes the agent will need. Used as `Authorization: Bearer <token>`.
-GITHUB_MCP_TOKEN=
-
 # === Optional: Sentry CLI (https://cli.sentry.dev) ===
 # Used by the bundled `sentry` CLI. For non-interactive auth, run
 # `sentry auth login --token "$SENTRY_AUTH_TOKEN"` from inside an OpenCode
@@ -43,6 +32,12 @@ SENTRY_AUTH_TOKEN=
 # Self-hosted Sentry endpoint (omit for sentry.io).
 # SENTRY_URL=https://sentry.example.com
 
+# === Optional: GitHub CLI (https://cli.github.com) ===
+# Used by the bundled `gh` CLI. gh auto-detects this env var on every
+# invocation, so auth survives Railway redeploys with no on-disk state.
+# Use a PAT with the scopes you need (typical: repo, read:org, workflow).
+GH_TOKEN=
+
 # === Optional: outbound proxy ===
 # HTTPS_PROXY=
 # HTTP_PROXY=
diff --git a/README.md b/README.md
index 4e0c4e5..5f1a410 100644
--- a/README.md
+++ b/README.md
@@ -8,10 +8,7 @@ Self-hosted [OpenCode](https://opencode.ai) web UI in a Docker image, ready to d
 
 - **OpenCode** built from source from the [`BYK/opencode`](https://github.com/BYK/opencode/tree/byk/cumulative) fork (`byk/cumulative` branch) — carries question-dock UX, plan-mode, and db perf fixes that aren't yet in upstream. Built fresh into the image; auto-update is effectively disabled because the fork has no release feed.
 - [Sentry CLI](https://cli.sentry.dev), GitHub CLI, **nvm + Node 22 LTS** (`pnpm` / `yarn` via corepack), **Bun**, plus `git`, `ripgrep`, `fd`, `fzf`, `jq`, `yq`, and `build-essential`.
-- **Three remote MCP servers** preconfigured; credentials are pulled from env vars via `{env:VAR}` substitution, so nothing sensitive is baked into the image:
-  - [Context7](https://context7.com) → `CONTEXT7_API_KEY`
-  - [GitHub MCP](https://github.com/github/github-mcp-server) → `GITHUB_MCP_TOKEN`
-  - [Sentry MCP](https://mcp.sentry.dev) → no env var
+- No MCP servers preconfigured — add your own via a project-local `opencode.json` or by editing [`opencode-user-config.json`](./opencode-user-config.json) before building.
 - Non-root `developer` user. OpenCode starts in `~/dev`. Mount a single persistent volume at `~/dev` (= `/home/developer/dev`) to keep your projects **and** OpenCode session/auth data across redeploys — `~/.local/share/opencode` is symlinked into `~/dev/.opencode`.
 
 ## Deploy on Railway
@@ -42,8 +39,8 @@ See [`.env.example`](./.env.example) for the full template.
 | Variable | What it does |
 |---|---|
 | One of `ANTHROPIC_API_KEY`, `OPENAI_API_KEY`, `GEMINI_API_KEY`, `GROQ_API_KEY`, `OPENROUTER_API_KEY` | **Required.** LLM provider key. |
-| `CONTEXT7_API_KEY`, `GITHUB_MCP_TOKEN` | Credentials for the preconfigured MCP servers. |
 | `SENTRY_AUTH_TOKEN`, `SENTRY_ORG`, `SENTRY_PROJECT`, `SENTRY_URL` | For the bundled `sentry` CLI. |
+| `GH_TOKEN` | For the bundled `gh` CLI. PAT with the scopes you need. |
 | `PORT` | Set automatically by most PaaS providers. Defaults to `4096`. |
 
 ## Local test
diff --git a/opencode-user-config.json b/opencode-user-config.json
index 3fe585b..cbf03ee 100644
--- a/opencode-user-config.json
+++ b/opencode-user-config.json
@@ -2,26 +2,5 @@
   "$schema": "https://opencode.ai/config.json",
   "plugin": [
     "@loreai/opencode@latest"
-  ],
-  "mcp": {
-    "context7": {
-      "type": "remote",
-      "url": "https://mcp.context7.com/mcp",
-      "headers": {
-        "CONTEXT7_API_KEY": "{env:CONTEXT7_API_KEY}"
-      }
-    },
-    "github": {
-      "type": "remote",
-      "url": "https://api.githubcopilot.com/mcp/",
-      "headers": {
-        "Authorization": "Bearer {env:GITHUB_MCP_TOKEN}"
-      }
-    },
-    "sentry": {
-      "type": "remote",
-      "url": "https://mcp.sentry.dev/mcp",
-      "headers": {}
-    }
-  }
+  ]
 }