feat!: rename the required env var token to SYSDIG_MCP_API_TOKEN

Author: tembleking

.envrc

@@ -3,4 +3,4 @@ watch_file *.nix
 dotenv_if_exists .env # You can create a .env file with your env vars for this project. You can also use .secrets if you are using act. See the line below.
 dotenv_if_exists .secrets # Used by [act](https://nektosact.com/) to load secrets into the pipelines
 strict_env
-env_vars_required SYSDIG_MCP_API_HOST SYSDIG_MCP_API_SECURE_TOKEN
+env_vars_required SYSDIG_MCP_API_HOST SYSDIG_MCP_API_TOKEN

.github/workflows/test.yaml

@@ -30,7 +30,7 @@ jobs:
         run: just check
         env:
           SYSDIG_MCP_API_HOST: ${{ vars.SYSDIG_MCP_API_HOST }}
-          SYSDIG_MCP_API_SECURE_TOKEN: ${{ secrets.SYSDIG_MCP_API_SECURE_TOKEN }}
+          SYSDIG_MCP_API_TOKEN: ${{ secrets.SYSDIG_MCP_API_SECURE_TOKEN }}
   build:
     name: Build
     runs-on: ubuntu-latest

AGENTS.md

@@ -71,7 +71,7 @@ Note that if you add more tools you need to also update this file to reflect tha
 
 ## Troubleshooting & Tips
 
-- **Missing config:** `SYSDIG_MCP_API_HOST` and `SYSDIG_MCP_API_SECURE_TOKEN` are mandatory in `stdio`. Validation fails early in `internal/config/config.go`.
+- **Missing config:** `SYSDIG_MCP_API_HOST` and `SYSDIG_MCP_API_TOKEN` are mandatory in `stdio`. Validation fails early in `internal/config/config.go`.
 - **Token scope:** If a tool does not appear, verify the token’s permissions under **Settings > Users & Teams > Roles**. `generate_sysql` currently requires a regular user token, not a Service Account.
 - **Remote auth:** When using `streamable-http` or `sse`, pass `Authorization: Bearer <token>` and optionally `X-Sysdig-Host`. These values override env vars via the request context middleware.
 - **Environment drift:** Always run inside `nix develop`; lint/test expect binaries like `gofumpt`, `golangci-lint`, and `ginkgo` provided by the flake.

README.md

@@ -65,12 +65,12 @@ Get up and running with the Sysdig MCP Server quickly using our pre-built Docker
                 "-e",
                 "SYSDIG_MCP_TRANSPORT",
                 "-e",
-                "SYSDIG_MCP_API_SECURE_TOKEN",
+                "SYSDIG_MCP_API_TOKEN",
                 "ghcr.io/sysdiglabs/sysdig-mcp-server:latest"
             ],
             "env": {
               "SYSDIG_MCP_API_HOST": "<your_sysdig_host>",
-              "SYSDIG_MCP_API_SECURE_TOKEN": "<your_sysdig_secure_api_token>",
+              "SYSDIG_MCP_API_TOKEN": "<your_sysdig_secure_api_token>",
               "SYSDIG_MCP_TRANSPORT": "stdio"
             }
           }
@@ -122,7 +122,7 @@ The server dynamically filters the available tools based on the permissions asso
 The following environment variables are **required** for configuring the Sysdig SDK:
 
 - `SYSDIG_MCP_API_HOST`: The URL of your Sysdig Secure instance (e.g., `https://us2.app.sysdig.com`). **Required when using `stdio` transport.**
-- `SYSDIG_MCP_API_SECURE_TOKEN`: Your Sysdig Secure API token. **Required only when using `stdio` transport.**
+- `SYSDIG_MCP_API_TOKEN`: Your Sysdig Secure API token. **Required only when using `stdio` transport.**
 
 You can also set the following variables to override the default configuration:
 
@@ -143,7 +143,7 @@ You can find your API token in the Sysdig Secure UI under **Settings > Sysdig Se
 ```bash
 # Required
 SYSDIG_MCP_API_HOST=https://us2.app.sysdig.com
-SYSDIG_MCP_API_SECURE_TOKEN=your-api-token-here
+SYSDIG_MCP_API_TOKEN=your-api-token-here
 
 # Optional
 SYSDIG_MCP_TRANSPORT=stdio
@@ -158,7 +158,7 @@ SYSDIG_MCP_TRANSPORT=streamable-http
 
 # Optional (Host and Token can be provided via HTTP headers)
 # SYSDIG_MCP_API_HOST=https://us2.app.sysdig.com
-# SYSDIG_MCP_API_SECURE_TOKEN=your-api-token-here
+# SYSDIG_MCP_API_TOKEN=your-api-token-here
 SYSDIG_MCP_LISTENING_PORT=8080
 SYSDIG_MCP_LISTENING_HOST=localhost
 SYSDIG_MCP_MOUNT_PATH=/sysdig-mcp-server
@@ -204,13 +204,13 @@ You can run the MCP server using Docker (recommended for production) or directly
 The easiest way to run the server is using the pre-built Docker image from GitHub Container Registry (as shown in the [Quickstart Guide](#quickstart-guide)).
 
 ```bash
-docker run -e SYSDIG_MCP_API_HOST=<your_sysdig_host> -e SYSDIG_MCP_API_SECURE_TOKEN=<your_sysdig_secure_api_token> -e SYSDIG_MCP_TRANSPORT=stdio -p 8080:8080 ghcr.io/sysdiglabs/sysdig-mcp-server:latest
+docker run -e SYSDIG_MCP_API_HOST=<your_sysdig_host> -e SYSDIG_MCP_API_TOKEN=<your_sysdig_secure_api_token> -e SYSDIG_MCP_TRANSPORT=stdio -p 8080:8080 ghcr.io/sysdiglabs/sysdig-mcp-server:latest
 ```
 
 To use the `streamable-http` or `sse` transports (for remote MCP clients), set the `SYSDIG_MCP_TRANSPORT` environment variable accordingly:
 
 ```bash
-docker run -e SYSDIG_MCP_TRANSPORT=streamable-http -e SYSDIG_MCP_API_HOST=<your_sysdig_host> -e SYSDIG_MCP_API_SECURE_TOKEN=<your_sysdig_secure_api_token> -p 8080:8080 ghcr.io/sysdiglabs/sysdig-mcp-server:latest
+docker run -e SYSDIG_MCP_TRANSPORT=streamable-http -e SYSDIG_MCP_API_HOST=<your_sysdig_host> -e SYSDIG_MCP_API_TOKEN=<your_sysdig_secure_api_token> -p 8080:8080 ghcr.io/sysdiglabs/sysdig-mcp-server:latest
 ```
 
 ### Go
@@ -294,12 +294,12 @@ For the Claude Desktop app, you can manually configure the MCP server by editing
               "-e",
               "SYSDIG_MCP_TRANSPORT",
               "-e",
-              "SYSDIG_MCP_API_SECURE_TOKEN",
+              "SYSDIG_MCP_API_TOKEN",
               "ghcr.io/sysdiglabs/sysdig-mcp-server:latest"
           ],
           "env": {
             "SYSDIG_MCP_API_HOST": "<your_sysdig_host>",
-            "SYSDIG_MCP_API_SECURE_TOKEN": "<your_sysdig_secure_api_token>",
+            "SYSDIG_MCP_API_TOKEN": "<your_sysdig_secure_api_token>",
             "SYSDIG_MCP_TRANSPORT": "stdio"
           }
         }
@@ -320,7 +320,7 @@ For the Claude Desktop app, you can manually configure the MCP server by editing
             ],
           "env": {
             "SYSDIG_MCP_API_HOST": "<your_sysdig_host>",
-            "SYSDIG_MCP_API_SECURE_TOKEN": "<your_sysdig_secure_api_token>",
+            "SYSDIG_MCP_API_TOKEN": "<your_sysdig_secure_api_token>",
             "SYSDIG_MCP_TRANSPORT": "stdio"
           }
         }
@@ -362,7 +362,7 @@ For the Claude Desktop app, you can manually configure the MCP server by editing
       env_keys:
       - SYSDIG_MCP_TRANSPORT
       - SYSDIG_MCP_API_HOST
-      - SYSDIG_MCP_API_SECURE_TOKEN
+      - SYSDIG_MCP_API_TOKEN
       envs:
         SYSDIG_MCP_TRANSPORT: stdio
       name: sysdig-mcp-server

cmd/server/main.go

@@ -94,6 +94,7 @@ func setupHandler(sysdigClient sysdig.ExtendedClientWithResponsesInterface) *mcp
 		tools.NewToolGetEventProcessTree(sysdigClient),
 		tools.NewToolRunSysql(sysdigClient),
 		tools.NewToolGenerateSysql(sysdigClient),
+
 		tools.NewKubernetesListClusters(sysdigClient),
 	)
 	return handler

internal/config/config.go

@@ -20,15 +20,15 @@ func (c *Config) Validate() error {
 		return fmt.Errorf("required configuration missing: SYSDIG_MCP_API_HOST")
 	}
 	if c.Transport == "stdio" && c.APIToken == "" {
-		return fmt.Errorf("required configuration missing: SYSDIG_MCP_API_SECURE_TOKEN")
+		return fmt.Errorf("required configuration missing: SYSDIG_MCP_API_TOKEN")
 	}
 	return nil
 }
 
 func Load() (*Config, error) {
 	cfg := &Config{
 		APIHost:       getEnv("SYSDIG_MCP_API_HOST", ""),
-		APIToken:      getEnv("SYSDIG_MCP_API_SECURE_TOKEN", ""),
+		APIToken:      getEnv("SYSDIG_MCP_API_TOKEN", ""),
 		Transport:     getEnv("SYSDIG_MCP_TRANSPORT", "stdio"),
 		ListeningHost: getEnv("SYSDIG_MCP_LISTENING_HOST", "localhost"),
 		ListeningPort: getEnv("SYSDIG_MCP_LISTENING_PORT", "8080"),

internal/config/config_test.go

@@ -58,7 +58,7 @@ var _ = Describe("Config", func() {
 				}
 				err := cfg.Validate()
 				Expect(err).To(HaveOccurred())
-				Expect(err.Error()).To(ContainSubstring("SYSDIG_MCP_API_SECURE_TOKEN"))
+				Expect(err.Error()).To(ContainSubstring("SYSDIG_MCP_API_TOKEN"))
 			})
 		})
 	})
@@ -71,7 +71,7 @@ var _ = Describe("Config", func() {
 		Context("with required env vars set for stdio", func() {
 			BeforeEach(func() {
 				_ = os.Setenv("SYSDIG_MCP_API_HOST", "host")
-				_ = os.Setenv("SYSDIG_MCP_API_SECURE_TOKEN", "token")
+				_ = os.Setenv("SYSDIG_MCP_API_TOKEN", "token")
 			})
 
 			It("should load default values", func() {
@@ -105,7 +105,7 @@ var _ = Describe("Config", func() {
 		Context("with all env vars set", func() {
 			BeforeEach(func() {
 				_ = os.Setenv("SYSDIG_MCP_API_HOST", "env-host")
-				_ = os.Setenv("SYSDIG_MCP_API_SECURE_TOKEN", "env-token")
+				_ = os.Setenv("SYSDIG_MCP_API_TOKEN", "env-token")
 				_ = os.Setenv("SYSDIG_MCP_TRANSPORT", "http")
 				_ = os.Setenv("SYSDIG_MCP_LISTENING_HOST", "0.0.0.0")
 				_ = os.Setenv("SYSDIG_MCP_LISTENING_PORT", "9090")

internal/infra/sysdig/client_generate_sysql_integration_test.go

@@ -15,7 +15,7 @@ var _ = Describe("Sysdig Generate Sysql Client", func() {
 
 	BeforeEach(func() {
 		sysdigURL := os.Getenv("SYSDIG_MCP_API_HOST")
-		sysdigToken := os.Getenv("SYSDIG_MCP_API_SECURE_TOKEN")
+		sysdigToken := os.Getenv("SYSDIG_MCP_API_TOKEN")
 
 		var err error
 		client, err = sysdig.NewSysdigClient(sysdig.WithFixedHostAndToken(sysdigURL, sysdigToken))

internal/infra/sysdig/client_permissions_integration_test.go

@@ -17,7 +17,7 @@ var _ = Describe("Sysdig Permissions Client", func() {
 
 	BeforeEach(func() {
 		sysdigURL = os.Getenv("SYSDIG_MCP_API_HOST")
-		sysdigToken = os.Getenv("SYSDIG_MCP_API_SECURE_TOKEN")
+		sysdigToken = os.Getenv("SYSDIG_MCP_API_TOKEN")
 	})
 
 	Context("when fetching user permissions", func() {

internal/infra/sysdig/client_process_tree_integration_test.go

@@ -18,7 +18,7 @@ var _ = Describe("Sysdig Process Tree Client", func() {
 
 	BeforeEach(func() {
 		sysdigURL := os.Getenv("SYSDIG_MCP_API_HOST")
-		sysdigToken := os.Getenv("SYSDIG_MCP_API_SECURE_TOKEN")
+		sysdigToken := os.Getenv("SYSDIG_MCP_API_TOKEN")
 
 		var err error
 		client, err = sysdig.NewSysdigClient(sysdig.WithFixedHostAndToken(sysdigURL, sysdigToken))