[BUG] Enterprise managed-mcp.json silently blocks all claude.ai cloud MCP connectors

Preflight Checklist

• [x] I have searched existing issues and this hasn't been reported yet
• [x] This is a single bug report (please file separate reports for different bugs)
• [x] I am using the latest version of Claude Code

What's Wrong?

When /etc/claude-code/managed-mcp.json exists (enterprise MCP configuration), all claude.ai cloud MCP connectors are silently blocked. The cloud MCP fetch function is never called because the enterprise guard short-circuits both code paths:

• Interactive mode (React hook): if (K || H46()) V = Promise.resolve({}) – skips cloud fetch entirely
• Print mode: R6 && !A6 && !H46() && !Y9() – guard evaluates false, skips cloud fetch

No error, no warning, no log output. The servers simply don't appear. claude mcp list only shows the enterprise-defined servers. Debug logs contain zero [claudeai-mcp] lines – the fetch function is never reached.

The API endpoint works perfectly – curl to /v1/mcp_servers returns all 5 configured cloud connectors. OAuth token has correct user:mcp_servers scope. Feature gate is true. The claudeai-proxy transport type also works perfectly when servers are manually injected into managed-mcp.json. The only problem is the client never fetches them.

What Should Happen?

Enterprise managed MCP should coexist with claude.ai cloud connectors. The enterprise config controls which local MCP servers are available – it should not silently disable cloud connectors configured at claude.ai/settings/connectors. At minimum, if intentional, there should be a clear log message explaining why cloud connectors are not loading.

Error Messages/Logs

# Sessions BEFORE enterprise config (working, Feb–Mar 7):
[claudeai-mcp] Checking gate (cached)...
[claudeai-mcp] Gate returned: true
[claudeai-mcp] Fetching from https://api.anthropic.com/v1/mcp_servers?limit=1000
[claudeai-mcp] Fetched 5 servers

# Sessions AFTER enterprise config (broken, Mar 27+):
# No [claudeai-mcp] log lines at all. Function never reached.

Steps to Reproduce

1. Deploy /etc/claude-code/managed-mcp.json with any valid enterprise MCP config (e.g. a few stdio/http servers)
2. Configure cloud MCP connectors at claude.ai/settings/connectors
3. Start Claude Code
4. Run claude mcp list – cloud connectors are missing
5. Check debug logs – no [claudeai-mcp] output at all
6. Manually inject claudeai-proxy entries into managed-mcp.json – claude mcp list now shows them and they connect successfully
7. Remove injected entries – cloud connectors disappear again

Claude Model

Opus

Is this a regression?

Yes, this worked in a previous version

Last Working Version

2.1.81

Claude Code Version

2.1.87

Platform

Anthropic API

Operating System

Other Linux

Terminal/Shell

WSL (Windows Subsystem for Linux)

Additional Information

Suggested fix: In gO6() and the React useEffect hook, the enterprise guard should not skip the cloud MCP fetch:

// Current (broken) – enterprise mode skips cloud fetch:
if (H46()) { return only enterprise servers }

// Fixed – enterprise mode should include cloud servers:
if (H46()) { return enterprise servers + cloud servers from pO6() }

Workaround: A SessionStart hook that fetches cloud servers from the API and merges them into managed-mcp.json:

#!/bin/bash
set -euo pipefail
CREDS_JSON="$HOME/.claude/.credentials.json"
MANAGED_MCP="/etc/claude-code/managed-mcp.json"
[ ! -f "$CREDS_JSON" ] || [ ! -f "$MANAGED_MCP" ] && exit 0
ACCESS_TOKEN=$(jq -r '.claudeAiOauth.accessToken // empty' "$CREDS_JSON" 2>/dev/null)
[ -z "$ACCESS_TOKEN" ] && exit 0
CLOUD_SERVERS=$(curl -s --max-time 5 \
    -H "Authorization: Bearer $ACCESS_TOKEN" \
    -H "anthropic-beta: mcp-servers-2025-12-04" \
    -H "anthropic-version: 2023-06-01" \
    "https://api.anthropic.com/v1/mcp_servers?limit=1000" 2>/dev/null) || true
[ -z "$CLOUD_SERVERS" ] && exit 0
echo "$CLOUD_SERVERS" | jq -e '.data' &>/dev/null || exit 0
tmp=$(mktemp)
jq --argjson cloud "$CLOUD_SERVERS" '
    ($cloud.data // []) as $servers |
    reduce $servers[] as $srv (.;
        .mcpServers["claude.ai \($srv.display_name)"] = {
            type: "claudeai-proxy", url: $srv.url, id: $srv.id
        }
    )
' "$MANAGED_MCP" > "$tmp" && mv "$tmp" "$MANAGED_MCP"
exit 0

Related issues: #21874, #32955, #24825