Test-account exception covers only local hosts, which blocks seeding demo users on remote, org-controlled environments
What happens
Claude Code declines to create disposable test users on our remote, organization-owned demo environment, both through our MCP tool and through direct calls to our application's admin REST API. It cites the prohibited-actions rule "Creating accounts, or entering passwords to authenticate", which holds even when the user explicitly authorizes the action.
Why
The "Testing the user's own application" exception (added for #78985) allows test accounts only when the application is served from a local development host: localhost, 127.0.0.1, [::1], *.localhost or *.test. A remote demo or staging environment fails that condition, however it is owned or controlled. The assistant applies the rule correctly. The problem is its scope.
Workflow affected
We prepare sales demos on cloud-hosted instances of an application we develop. Preparing one means seeding buyer organizations, buyer logins with roles, and generated test passwords. The same applies to any team whose QA or staging runs on a remote host. Today a person has to run every seeding step by hand, so demo preparation cannot run unattended.
Not requested
Entering real users' credentials, registering on third-party services, or touching production.
Ask
Extend the exception to remote environments a person has explicitly designated, for example:
- a host allowlist in user-level or managed settings, set by a person and not by the model, page content or repository text;
- the same remaining conditions as today: the request comes from the user in chat, the values are test values (generated in the session or read from seed files), and real or production credentials are never used;
- optionally, a confirmation the first time a listed host is used in a session.
Related
#78985 (closed 2026-10-03, local-host exception), #96762, #93486.