---
title: "MCP server settings and prepare-step environments"
date: "2026-07-01"
---

## Manage MCP servers in Settings

Server-managed MCP definitions previously required direct API calls. The new **Settings → MCP Servers** pages provide list, create, edit, and delete flows for stdio, HTTP, and sandbox transports. Credential-like values get a nudge toward `{{ secrets.NAME }}` references, while stored header and environment values remain write-only in the UI.

## Prepare-step environments

Per-step environment values in `run.prepare.steps` were parsed but dropped before execution. Prepare commands and their environment values now reach the sandbox, resolve `{{ env.* }}` at the run boundary, and fail clearly when a required value is missing; argv-style commands are also shell-quoted correctly.

```toml
[[run.prepare.steps]]
command = ["npm", "install"]
env = { NPM_TOKEN = "{{ env.NPM_TOKEN }}" }
```

## More

<Accordion title="Fixes">
- `Sandbox::glob` now applies consistent `*`, `**`, and path-segment matching across local, Docker, and Daytona environments, restoring remote skill discovery and common agent glob searches
- Newly created GitHub Apps now include the organization Projects V2 permission required by project-tracker workflows
</Accordion>

<Accordion title="Improvements">
- Newly created GitHub Apps now request Dependabot alert read/write permission; existing apps require a manual permission update and installation approval
- Server-managed environments now live in SQLite, with legacy TOML definitions imported and renamed to a timestamped backup
</Accordion>
