openclaw - 💡(How to fix) Fix Feature: support SecretRef in mcp.servers.*.env fields

Summary

mcp.servers.<name>.env currently only accepts plain scalar values (string/number/boolean). There is no way to reference secrets via SecretRef, and openclaw secrets audit does not scan this config path — leaving API keys in mcp.servers silently exposed as plaintext in openclaw.json.

Current Behavior

mcp.servers.*.env schema:

"env": {
  "additionalProperties": {
    "anyOf": [
      { "type": "string" },
      { "type": "number" },
      { "type": "boolean" }
    ]
  }
}

Plain scalars only. No SecretRef object variant ({ source, provider, id }).

$ openclaw secrets audit
Secrets audit: clean. plaintext=0, unresolved=0, shadowed=0, legacy=0.
# ^ Reports clean even when mcp.servers.*.env contains plaintext API keys

Expected Behavior

1. mcp.servers.<name>.env should accept SecretRef objects in addition to plain strings:

{
  "mcp": {
    "servers": {
      "my-server": {
        "command": "npx",
        "args": ["-y", "@some/mcp-server"],
        "env": {
          "MY_API_KEY": { "source": "env", "provider": "default", "id": "MY_API_KEY" }
        }
      }
    }
  }
}

1. openclaw secrets audit should scan mcp.servers.*.env for plaintext secrets and report them.

Environment

• OpenClaw version: 2026.5.7
• OS: Darwin 25.3.0 (arm64)

Workaround

None currently. ${VAR} interpolation support in mcp env is unconfirmed. Migrating to plugins.entries.acpx.config.mcpServers does not help — acpx is not installed by default and its env fields have the same plaintext-only constraint.