github plugin sends a malformed Authorization header when GITHUB_PERSONAL_ACCESS_TOKEN is unset

Plugin: github@claude-plugins-official

What happens With the plugin enabled and no GITHUB_PERSONAL_ACCESS_TOKEN in the environment, claude mcp list reports:

HTTP 400: Error POSTing to endpoint: bad request: Authorization header is badly formatted

The manifest always builds "Authorization": "Bearer ${GITHUB_PERSONAL_ACCESS_TOKEN}", so an unset variable becomes Bearer with no token. This happens even when the GitHub CLI (gh) is logged in, and its token is accepted by the same endpoint.

Expected

1. No Authorization header (or no connection attempt) when the variable is absent.
2. An explicit setup error that names the missing variable.
3. A way to authenticate without a long-lived token in the environment: OAuth, or a credential helper. Claude Code's headersHelper already supports this for user-configured servers, for example a helper that runs gh auth token.

Repro

1. Unset GITHUB_PERSONAL_ACCESS_TOKEN.
2. Enable github@claude-plugins-official.
3. Run claude mcp list.

Workaround we use Register https://api.githubcopilot.com/mcp/ at user scope with a headersHelper that prints {"Authorization":"Bearer <gh auth token>"}.

Related, but not the same cause:

• anthropics/claude-code#84367: the token is set, and a stray } from the template leaks into the header.
• anthropics/claude-code#90677: the token is set, but the VS Code extension does not pick it up.
• anthropics/claude-code#104338 and anthropics/claude-code#102062: the same 400 in cloud and desktop sessions, with no root cause given.