VS Code
Check the config into the repository. The secret is not in it.
VS Code agent mode reads MCP servers from a file in the workspace, which is exactly the file people are afraid to commit. With the gateway there is nothing in it worth stealing beyond an agent token you can rotate in one click.
Connect it
{
"servers": {
"sallyport": {
"type": "http",
"url": "https://mcp.sallyport.cloud/mcp",
"headers": { "Authorization": "Bearer ${input:sallyport_token}" }
}
}
}Keep the token in an input or in your own secret store and the file itself is safe to commit. Every developer on the repository then points at the same bindings, and the journal shows which of them ran what.