[BUG] Feature flag tengu_claudeai_mcp_connectors pushed server-side without consent

Preflight Checklist

• [x] I have searched existing issues and this hasn't been reported yet
• [x] This is a single bug report (please file separate reports for different bugs)
• [x] I am using the latest version of Claude Code

What's Wrong?

During a routine Claude Code session startup, two previously unseen MCP servers appeared in my /mcp menu:

• claude.ai Gmail
• claude.ai Google Calendar

I did not install, configure, request, or consent to these integrations. They were silently enabled via a server-pushed GrowthBook feature flag (tengu_claudeai_mcp_connectors: true) in ~/.claude.json.

Both servers connect through mcp-proxy.anthropic.com and attempt OAuth authentication to Google services. They failed only because no OAuth token was
configured - meaning if I had previously authenticated with Google for any reason, these would have silently connected.

Why This Is Serious

I genuinely thought my machine had been compromised. When I saw "Google Calendar" and "Gmail" appearing in my MCP server list - servers I never installed -
my immediate reaction was that data was being exfiltrated to Google Drive. I spent significant time running a full security investigation: auditing network connections, reviewing MCP source code for exfiltration patterns, checking for unauthorized processes, and tracing the origin of these phantom servers.

This is exactly the kind of behaviour that erodes user trust. Users who carefully manage their MCP configurations and security posture should not have to forensically investigate their own tooling because Anthropic silently pushed third-party service integrations to their machine.

What Should Happen?

1. Opt-in, not opt-out. Any integration that connects to third-party services (Google, Microsoft, or otherwise) must require explicit user consent before activation. A feature flag flipped server-side is not consent. Present a clear prompt: "Would you like to enable Gmail and Google Calendar integration?" and respect a "No" permanently.

1. Visible notification on first appearance. If a new MCP server is added to the user's environment by any mechanism other than the user installing it themselves, Claude Code must clearly notify the user: what was added, what it connects to, what data it can access, and how to remove it. Silent addition is unacceptable.

1. Persistent user override. If a user disables this feature, that decision must be respected permanently. The current workaround - manually editing tengu_claudeai_mcp_connectors to false in ~/.claude.json - will likely be overwritten on the next GrowthBook sync. There needs to be a durable user-level setting (e.g., in settings.json) that overrides any server-pushed feature flags for third-party integrations.

1. Separate third-party integrations from core feature flags. Feature flags for UI tweaks and internal optimisations are one thing. Feature flags that establish connections to third-party services with access to personal email and calendar data are in an entirely different risk category and should be treated as such. These should never ship through the same mechanism as tengu_bash_haiku_prefetch.

1. Respect the principle of least surprise. A CLI developer tool should not be silently reaching out to Google services. Users choose Claude Code for its local, transparent operation. Undermining that expectation - even with good intentions - damages the trust relationship that makes the tool valuable in the first place.

Error Messages/Logs

- Claude Code CLI (latest, Linux x86_64)
  - Feature flag: tengu_claudeai_mcp_connectors set to true server-side via GrowthBook
- MCP proxy endpoints: mcp-proxy.anthropic.com/v1/mcp/mcpsrv_01CcL2kVXEpekz5Jai8Jtpnu (Gmail), mcp-proxy.anthropic.com/v1/mcp/mcpsrv_013mrT6Pk5r7dxhWdFM3dsAW
 (Google Calendar)

Steps to Reproduce

1. Install Claude Code v2.1.59 (or latest) on Linux
2. Start a new session: claude
3. Wait for GrowthBook feature flag sync to complete (happens automatically on startup)
4. Open the MCP menu by typing /mcp
5. Observe two unconfigured, unrequested servers in the list:

• claude.ai Gmail
• claude.ai Google Calendar

1. Confirm they were not locally configured by checking ~/.claude/settings.json and ~/.claude/settings.local.json - no Google entries exist
2. Confirm the flag was pushed server-side: grep tengu_claudeai_mcp_connectors ~/.claude.json returns true despite never being set by the user

Expected Result

No third-party service integrations appear unless the user explicitly installs and configures them.

Actual Result

Two Google service integrations appear in the MCP server list, connecting to mcp-proxy.anthropic.com, without any user action, notification, or consent.

Claude Model

Opus

Is this a regression?

No, this never worked

Last Working Version

_No response_

Claude Code Version

2.1.59

Platform

Anthropic API

Operating System

Ubuntu/Debian Linux

Terminal/Shell

Other

Additional Information

_No response_