Claude Code MCP Plugin auth header "X-Api-Key" not resolving env var from settings.local.json
A Claude Code plugin (installed via a .claude-plugin marketplace) ships a .mcp.json with an HTTP MCP server using an auth header like {"X-Api-Key": "${MY_API_KEY}"}. The variable is defined in the env block of ~/.claude/settings.local.json (a common place installers write keys expecting ${VAR} to resolve). The MCP server rejects the request with an invalid-credential error even though the settings env var is set correctly. Also: MCP servers declared inline under mcpServers in .claude-plugin/plugin.json are silently ignored (claude plugin details shows 'MCP servers (0)'); only a .mcp.json file at the plugin root is picked up.
Verified on Claude Code 2.1.223: ${VAR} placeholders in a plugin's .mcp.json headers resolve from the PROCESS environment only, not from the settings.local.json env block. With the process var unset, the server receives a non-empty bad credential (evidently the literal ${VAR} string), which shows up as 'invalid key' rather than 'no key' - misleading when debugging. Fixes: (1) export the variable in the shell that launches claude (e.g. via shell profile or a repo .env loaded before launch), or (2) avoid header-embedded secrets and bootstrap auth in-band (e.g. a device-code flow driven by the agent). Separately, put MCP config in <plugin-root>/.mcp.json, not inline in .claude-plugin/plugin.json - the inline form validates fine but never loads. Diagnose with claude plugin details <name> (shows the MCP server count) plus a no-auth health tool on the server.