[BUG] Feature flag tengu_claudeai_mcp_connectors pushed server-side without consent
Preflight Checklist
- [x] I have searched existing issues and this hasn't been reported yet
- [x] This is a single bug report (please file separate reports for different bugs)
- [x] I am using the latest version of Claude Code
What's Wrong?
During a routine Claude Code session startup, two previously unseen MCP servers appeared in my /mcp menu:
- claude.ai Gmail
- claude.ai Google Calendar
I did not install, configure, request, or consent to these integrations. They were silently enabled via a server-pushed GrowthBook feature flag (tengu_claudeai_mcp_connectors: true) in ~/.claude.json.
Both servers connect through mcp-proxy.anthropic.com and attempt OAuth authentication to Google services. They failed only because no OAuth token was
configured - meaning if I had previously authenticated with Google for any reason, these would have silently connected.
Why This Is Serious
I genuinely thought my machine had been compromised. When I saw "Google Calendar" and "Gmail" appearing in my MCP server list - servers I never installed -
my immediate reaction was that data was being exfiltrated to Google Drive. I spent significant time running a full security investigation: auditing network connections, reviewing MCP source code for exfiltration patterns, checking for unauthorized processes, and tracing the origin of these phantom servers.
This is exactly the kind of behaviour that erodes user trust. Users who carefully manage their MCP configurations and security posture should not have to forensically investigate their own tooling because Anthropic silently pushed third-party service integrations to their machine.
What Should Happen?
- Opt-in, not opt-out. Any integration that connects to third-party services (Google, Microsoft, or otherwise) must require explicit user consent before activation. A feature flag flipped server-side is not consent. Present a clear prompt: "Would you like to enable Gmail and Google Calendar integration?" and respect a "No" permanently.
- Visible notification on first appearance. If a new MCP server is added to the user's environment by any mechanism other than the user installing it themselves, Claude Code must clearly notify the user: what was added, what it connects to, what data it can access, and how to remove it. Silent addition is unacceptable.
- Persistent user override. If a user disables this feature, that decision must be respected permanently. The current workaround - manually editing tengu_claudeai_mcp_connectors to false in ~/.claude.json - will likely be overwritten on the next GrowthBook sync. There needs to be a durable user-level setting (e.g., in settings.json) that overrides any server-pushed feature flags for third-party integrations.
- Separate third-party integrations from core feature flags. Feature flags for UI tweaks and internal optimisations are one thing. Feature flags that establish connections to third-party services with access to personal email and calendar data are in an entirely different risk category and should be treated as such. These should never ship through the same mechanism as tengu_bash_haiku_prefetch.
- Respect the principle of least surprise. A CLI developer tool should not be silently reaching out to Google services. Users choose Claude Code for its local, transparent operation. Undermining that expectation - even with good intentions - damages the trust relationship that makes the tool valuable in the first place.
Error Messages/Logs
- Claude Code CLI (latest, Linux x86_64)
- Feature flag: tengu_claudeai_mcp_connectors set to true server-side via GrowthBook
- MCP proxy endpoints: mcp-proxy.anthropic.com/v1/mcp/mcpsrv_01CcL2kVXEpekz5Jai8Jtpnu (Gmail), mcp-proxy.anthropic.com/v1/mcp/mcpsrv_013mrT6Pk5r7dxhWdFM3dsAW
(Google Calendar)Steps to Reproduce
- Install Claude Code v2.1.59 (or latest) on Linux
- Start a new session: claude
- Wait for GrowthBook feature flag sync to complete (happens automatically on startup)
- Open the MCP menu by typing /mcp
- Observe two unconfigured, unrequested servers in the list:
- claude.ai Gmail
- claude.ai Google Calendar
- Confirm they were not locally configured by checking ~/.claude/settings.json and ~/.claude/settings.local.json - no Google entries exist
- Confirm the flag was pushed server-side: grep tengu_claudeai_mcp_connectors ~/.claude.json returns true despite never being set by the user
Expected Result
No third-party service integrations appear unless the user explicitly installs and configures them.
Actual Result
Two Google service integrations appear in the MCP server list, connecting to mcp-proxy.anthropic.com, without any user action, notification, or consent.
Claude Model
Opus
Is this a regression?
No, this never worked
Last Working Version
_No response_
Claude Code Version
2.1.59
Platform
Anthropic API
Operating System
Ubuntu/Debian Linux
Terminal/Shell
Other
Additional Information
_No response_
7 Comments
Found 3 possible duplicate issues:
This issue will be automatically closed as a duplicate in 3 days.
🤖 Generated with Claude Code
This is not a duplicate. This issue was introduced in the latest claude release 2.1.59
added dns block for mcp-proxy.anthropic.com
added additional block (^\|\.)mcp\.claude\.com$
Set ENABLE_CLAUDEAI_MCP_SERVERS=false environment variable. This is the official opt-out mechanism documented in the Claude Code binary itself: "To opt out, set ENABLE_CLAUDEAI_MCP_SERVERS=false". The env var is checked AFTER the GrowthBook gate and cannot be overwritten by server-side flag refreshes.
Yes, took me about twenty minutes to find a way to disable these two MCP servers (the Gmail and Calendar MCPs) (I didn't see this post until after). /mcp only showed what they were but didn't let me disable them. Instead, they're nestled underneath all other plugins, accessible via your /plugin slash-command. I pressed spacebar to disable each of them.
But my gripe, similar to manfromdownunder, is that I never consented to enabling these two third-party MCPs in the first place. Furthermore, I had a hard time finding how to disable them. They weren't found on my claude.ai account nor in my settings.json. I ended up finding them under .claude.json which is a hidden config file with a ton of tengu flags. Yes, I know tengu was used as a codename for Claude Code, so it's not a security issue, but the behavior of claude code automatically trying to auth with services I didn't set up myself bypasses user consent and is also plain annoying, as "claude.ai connectors need auth" warnings kept popping up in my sessions. Hey, at least it's failing loudly, so I could tell that they're trying to access these servers in the first place!
This issue has been automatically locked since it was closed and has not had any activity for 7 days. If you're experiencing a similar issue, please file a new issue and reference this one if it's relevant.