[BUG] --disallowedTools flag does not affect MCP server tools

What's Wrong?

The --disallowedTools CLI flag has no effect on MCP server tools when using -p (print/non-interactive) mode. Built-in tools are correctly blocked, but MCP tools remain available regardless of the flag value.

What Should Happen?

MCP tools should be blocked when specified in --disallowedTools, either by server name (mcp__servername) or by individual tool name (mcp__servername__toolname).

Steps to Reproduce

1. Have MCP servers configured (e.g., context7, playwright)
2. Run with --disallowedTools attempting to block MCP tools:

# Attempt 1: Block by server name (space-separated)
claude -p "What tools do you have?" \
  --system-prompt "List your tools" \
  --disallowedTools "mcp__context7" "mcp__playwright"

# Attempt 2: Block by server name (comma-separated)
claude -p "What tools do you have?" \
  --system-prompt "List your tools" \
  --disallowedTools "mcp__context7,mcp__playwright"

# Attempt 3: Block individual tools
claude -p "What tools do you have?" \
  --system-prompt "List your tools" \
  --disallowedTools "mcp__context7__resolve-library-id" "mcp__context7__get-library-docs"

# Attempt 4: Block built-in tools (this works correctly)
claude -p "What tools do you have?" \
  --system-prompt "List your tools" \
  --disallowedTools "Bash" "Edit" "Read"

1. In all MCP-related attempts, Claude still lists and can use the MCP tools
2. Built-in tools are correctly blocked in attempt 4

Error Messages/Logs

No error messages - the flag is silently ignored for MCP tools.

Is this a regression?

I don't know

Claude Code Version

2.0.56 (Claude Code)

Platform

Anthropic API

Operating System

Other Linux

Terminal/Shell

Non-interactive/CI environment

Additional Information

Use case: Running Claude in automated/SDK contexts where MCP servers should be disabled for a clean, controlled environment.

Current workaround: Temporarily remove MCP servers from configuration before running tests, then re-add them afterwards. This is cumbersome for automated pipelines.

Documentation reference: The CLI reference documents the permission syntax for MCP tools:

• mcp__servername - matches all tools from a server
• mcp__servername__toolname - matches a specific tool

Neither format works with --disallowedTools.

Related issues:

• #12232 - --allowedTools behaviour with --permission-mode bypassPermissions