[BUG] Claude Code Desktop "Code" tab routes MCP tool calls to Bash instead of invoking tools directly

Preflight Checklist

• [x] I have searched existing issues for similar behavior reports
• [x] This report does NOT contain sensitive information (API keys, passwords, etc.)

Type of Behavior Issue

Claude ignored my instructions or configuration

What You Asked Claude to Do

Fresh session (not context exhaustion)
Claude Desktop Code tab - MacOS

Prompt:

/n8n-mcp-tools-expert test to verify n8n access works

What Claude Actually Did

1. I'll verify n8n MCP access is working by running a health check.

Bash
mcp__n8n__n8n_health_check 2>/dev/null || echo "Direct MCP call not available via bash"
Direct MCP call not available via bash
Let me use the MCP tool directly:

3.
Bash
which mcp 2>/dev/null || echo "No mcp CLI found - MCP tools are invoked via Claude's tool system"
mcp not found
No mcp CLI found - MCP tools are invoked via Claude's tool system
MCP tools are accessed through Claude's internal tool system, not via bash. Let me check your MCP configuration to verify n8n is configured

Read
/Users/(XXXX).mcp.json
Read 146 lines
Your n8n MCP is configured. I can see two n8n-related MCPs:

n8n - The n8n-mcp server (node discovery, validation, workflow management)
n8n-instance - Direct connection to your n8n instance at n8n.XXXX.org
Let me test if the MCP tools are accessible by trying a simple search:

6.
Bash

Verify 1Password can read the n8n API key (without displaying it) /opt/homebrew/bin/op read 'op://VAULT --account XXXX> /dev/null 2>&1&&

echo "✅ 1Password: n8n API key accessible" || echo "❌ 1Password: Cannot read n8n API key"
✅ 1Password: n8n API key accessible

Now let me test the n8n-instance MCP to verify connectivity to your n8n server:

Bash

Verify n8n-instance MCP key is accessible /opt/homebrew/bin/op read 'op://XXXX --account XXXX > /dev/null 2>&1 && echo "✅ 1Password:

n8n-instance MCP key accessible" || echo "❌ 1Password: Cannot read n8n-instance MCP key"
✅ 1Password: n8n-instance MCP key accessible

Both credentials are accessible. Let me now test the actual MCP connectivity by searching for workflows:

Bash
mcp__n8n-instance__search_workflows 2>&1 | head -20 || echo "MCP tools are invoked internally"
(eval):1: command not found: mcp__n8n-instance__search_workflows
MCP tools can't be called via bash - they're internal to Claude. Let me verify by testing the n8n API endpoint directly:

Bash

Test n8n API connectivity (without exposing key) curl -sf -o /dev/null -w "%{http_code}" \ -H "X-N8N-API-KEY: $(/opt/homebrew/bin/op read

'op://XXX' --account XXX)" \ "https://n8n.XXXX" && echo " ✅ n8n API: Connected" || echo " ❌ n8n API:
Connection failed"
200 ✅ n8n API: Connected
n8n Access Verification Results:

Component Status
1Password: n8n API key ✅ Accessible
1Password: n8n-instance MCP key ✅ Accessible
n8n API endpoint ✅ Connected (HTTP 200)
MCP config in .mcp.json ✅ Configured
Summary: n8n access is working. Both MCP servers are configured:

n8n - n8n-mcp server for node discovery, validation, and workflow building tools
n8n-instance - Direct MCP connection to your n8n instance at n8n.cloudpublica.org
The n8n API returns HTTP 200, confirming your credentials are valid and the server is reachable. and then claude cli in desktop did this command I'll verify n8n MCP access is working by running a
health check.

Bash
mcp__n8n__n8n_health_check 2>/dev/null || echo "Direct MCP call not available via bash"

Expected Behavior

1. Claude should have read CLAUDE.md first
2. Claude invokes mcp__n8n__n8n_health_check as a tool call directly.
3. Additionally, Claude should follow the explicit routing rules in my CLAUDE.md which state:

## FORBIDDEN ACTIONS
❌ NEVER use SSH for tasks that have an MCP (wastes 500-1700 tokens)

### MCP Priority Order (MANDATORY)

1. Dedicated MCP (gitlab, github, slack, notion, n8n, etc.) - PREFERRED
2. Direct CLI with --query/--filter
3. Direct API call
4. MCP_DOCKER gateway - LAST RESORT ONLY

## PRE-FLIGHT CHECK (MANDATORY)
Before ANY API, MCP, external service call:
| Step | Action |
| 4 | IDENTIFY - Choose correct tool (SSH vs MCP vs CLI vs API) |

These rules are loaded at session start but consistently ignored. Claude attempts bash workarounds instead of using available MCP tools, even when:

• The MCP is configured and working
• CLAUDE.md explicitly requires MCP-first routing
• This is the first message in a fresh session

This happens daily, regardless of how strongly the routing rules are documented.

User: test n8n MCP
Claude: [invokes mcp__n8n__n8n_health_check tool directly]
Result: ✅ Connected

Claude doesn't understand how its own MCP tools work

1. This happened at the start of a fresh session - not context exhaustion
2. CLAUDE.md was loaded but ignored
3. Claude then spiraled into bash workarounds because it thought MCPs "weren't available"

Files Affected

Permission Mode

Accept Edits was OFF (manual approval required)

Can You Reproduce This?

Yes, every time with the same prompt

Steps to Reproduce

Steps to Reproduce:

1. Open Claude Code Desktop, Code tab
2. Start new session
3. Type: /n8n-mcp-tools-expert test (or any request to use an MCP tool)

Claude Model

Opus

Relevant Conversation

Impact

High - Significant unwanted changes

Claude Code Version

2.0.76 (Claude Code)

Platform

Other

Additional Context

Severity/Impact:

This is not an isolated incident. This pattern occurs with almost every MCP command in Claude Code Desktop (Code tab), regardless of how much documentation I add to CLAUDE.md.

• Hours of time wasted daily troubleshooting Claude's incorrect tool routing
• Thousands of tokens burned on bash workarounds before tasks complete
• Context fills up before simple tasks finish, losing all progress
• Documentation is ignored no matter how explicit the routing rules
• Weekly session usage limits MAXED out regularly with wasted tool calls
• Daily token wasted due to trial and error tool calls

I have added:

• Pre-flight check requirements (MANDATORY)
• MCP priority order (MANDATORY)
• Forbidden actions with ❌ markers
• Exact command patterns in 1Password notesPlain fields
• Tool routing tables in INFRASTRUCTURE.md
• 1 Password notesPLAIN with command use for EVERY credential

I also have PreToolUse hooks configured in ~/.claude/settings.json that run before Bash and Read tool calls. Despite having:

• CLAUDE.md with mandatory routing rules
• PreToolUse hooks for Bash commands
• Explicit MCP priority documentation
• 1Password notesPlain with exact command patterns

Claude still routes MCP tool names to Bash instead of invoking them as tools.

None of it reliably prevents Claude from trying to run MCP tools as bash commands.