Default empty string prevents env var fallback

[joey-kendall]

Is this a support request?
No.

Describe the bug
When --api-key is not provided via CLI args, the fallback to the LAUNCHDARKLY_API_KEY environment variable never works. The CLI defaults --api-key to an empty string "", and the nullish coalescing operator (??) in the security module doesn't treat "" as nullish, so the env var is never read.

This results in an Invalid account ID header error from the API.

To reproduce

1. Set LAUNCHDARKLY_API_KEY as a process environment variable with a valid API token
2. Start the server without --api-key: npx -y @launchdarkly/mcp-server start
3. Call any tool (e.g., list-feature-flags)
4. Observe Invalid account ID header error

This particularly affects MCP clients (like Claude Code) that set environment variables on the spawned process rather than passing them through shell-expanded CLI args.

Expected behavior
When --api-key is not provided, the SDK should fall through to the LAUNCHDARKLY_API_KEY environment variable as defined in lib/env.js.

Logs

Invalid account ID header

Root cause (from source inspection):

In dist/esm/mcp-server/cli/start/impl.js (line 31):

...{ apiKey: flags["api-key"] ?? "" },

This sets apiKey to "" when --api-key is not provided.

Then in dist/esm/lib/security.js (line 127):

value: security?.apiKey ?? env().LAUNCHDARKLY_API_KEY,

Since "" is not null or undefined, ?? does not fall through to the env var.

Suggested fix:

// Change from:
{ apiKey: flags["api-key"] ?? "" }

// To:
{ apiKey: flags["api-key"] ?? undefined }

Package version
@launchdarkly/mcp-server 0.4.2

Language version, developer tools
Node v22, Claude Code

OS/platform
macOS (Darwin 25.2.0)

Additional context
The --api-key flag works correctly when the token is passed directly in the args. The issue is only with the env var fallback path.

[nieblara]

Thanks for reporting! We're queueing this up to check out soon!