Scoped MCP servers for skills and subagents

Summary

Allow MCP servers to be dynamically loaded and scoped exclusively to specific skills or subagents, without exposing them to the main/parent agent.

Motivation

When building agents that need specialized tools — for example, a QA tester subagent with Playwright browser access — the MCP server is currently configured globally and visible to all agents including the parent. This creates two problems:

1. Context pollution: The main agent sees browser MCP tools it shouldn't use, and may be tempted to call them directly instead of delegating to the specialized subagent.
2. No isolation: There's no way to make an MCP server available only to a subagent or skill. The mcpServers frontmatter field in agent definitions is additive — it selects from globally-configured servers but doesn't hide them from the parent.

Proposed Behavior

• Skills and subagent definitions (.claude/skills/*/ and .claude/agents/*.md) should support defining MCP servers that are only loaded when that skill/agent is invoked.
• These MCP servers would not appear in the main agent's tool list.
• The MCP server process would start on demand when the skill/agent runs and stop when it finishes.

Example: agent definition

---
name: qa-tester
description: Browser-based QA tester
mcpServers:
  playwright:
    command: npx
    args: ["@anthropic/playwright-mcp"]
    scope: agent-only   # not visible to parent
---

Example: skill definition

---
mcpServers:
  - name: playwright
    command: npx
    args: ["@anthropic/playwright-mcp"]
---

Use Cases

• QA tester agent with browser tools (Playwright/Puppeteer) — parent gives high-level instructions, subagent handles browser interactions
• Database admin agent with DB access — parent can't accidentally run queries directly
• Deployment agent with infrastructure MCP tools — scoped to deployment skill only
• Research agent with web scraping tools — isolated from main coding context

Current Workarounds

• Adding CLAUDE.md instructions telling the main agent not to use certain MCP tools (soft constraint, not enforced)
• PreToolUse hooks to block MCP tool calls from the main agent (fragile, hard to scope correctly, doesn't solve context pollution with tools)

None of these provide true scoping or on-demand lifecycle management for MCP servers.