**Parent:** #623 MCP config allows arbitrary env vars to be injected into child processes. Restrict to known-safe subset or warn on suspicious env vars.
