diff --git a/cmd/karpor/app/server.go b/cmd/karpor/app/server.go
index 345f42fa..2f513c32 100644
--- a/cmd/karpor/app/server.go
+++ b/cmd/karpor/app/server.go
@@ -108,7 +108,9 @@ func NewServerCommand(ctx context.Context) *cobra.Command {
 		return o.SearchStorageOptions
 	}))
 	expvar.Publish("AIOptions", expvar.Func(func() interface{} {
-		return o.AIOptions
+		displayOpts := *o.AIOptions
+		displayOpts.AIAuthToken = "[hidden]"
+		return &displayOpts
 	}))
 	expvar.Publish("Version", expvar.Func(func() interface{} {
 		return version.GetVersion()
diff --git a/pkg/core/route/route.go b/pkg/core/route/route.go
index dc79aaec..3c336712 100644
--- a/pkg/core/route/route.go
+++ b/pkg/core/route/route.go
@@ -15,8 +15,10 @@
 package route
 
 import (
+	"encoding/json"
 	"errors"
 	"expvar"
+	"net/http"
 
 	docs "github.com/KusionStack/karpor/api/openapispec"
 	aggregatorhandler "github.com/KusionStack/karpor/pkg/core/handler/aggregator"
@@ -125,7 +127,7 @@ func NewCoreRoute(
 	router.Get("/endpoints", endpointhandler.Endpoints(router))
 
 	// Expose server configuration and runtime statistics.
-	router.Get("/server-configs", expvar.Handler().ServeHTTP)
+	router.Get("/server-configs", customVarHandler().ServeHTTP)
 
 	healthhandler.Register(router, generalStorage)
 	return router, nil
@@ -189,3 +191,29 @@ func setupRestAPIV1(
 	r.Get("/resource-groups/{resourceGroupRuleName}", resourcegrouphandler.List(resourceGroupMgr))
 	r.Get("/authn", authnhandler.Get())
 }
+
+func customVarHandler() http.Handler {
+	return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		w.Header().Set("Content-Type", "application/json")
+
+		w.Write([]byte("{"))
+		first := true
+
+		expvar.Do(func(kv expvar.KeyValue) {
+			if kv.Key == "memstats" || kv.Key == "cmdline" {
+				return // Skip memstats and cmdline
+			}
+			if !first {
+				w.Write([]byte(","))
+			} else {
+				first = false
+			}
+
+			b, _ := json.Marshal(kv.Key)
+			w.Write(b)
+			w.Write([]byte(":"))
+			w.Write([]byte(kv.Value.String()))
+		})
+		w.Write([]byte("}"))
+	})
+}