[BUG] Project-scoped .mcp.json not discovered — no permission prompt, servers never load

Preflight Checklist

• [x] I have searched existing issues and this hasn't been reported yet
• [x] This is a single bug report (please file separate reports for different bugs)
• [x] I am using the latest version of Claude Code

What's Wrong?

Claude Code does not discover .mcp.json at the project root. No permission prompt is shown, MCP servers are never initialized, and their tools are unavailable in the session. The file is silentlyignored

---
.mcp.json (project root):
{
"mcpServers": {
"remote-gateway": {
"url": "http://localhost:8000/sse"
},
"exa": {
"command": "npx",
"args": ["-y", "exa-mcp-server"],
"env": { "EXA_API_KEY": "${EXA_API_KEY}" }
}
}
}

~/.claude/settings.json:
{
"enabledMcpjsonServers": ["remote-gateway", "exa"],
"alwaysThinkingEnabled": true,
"enabledPlugins": {}
}

What Should Happen?

Claude Code detects .mcp.json at session startup, prompts the user to approve the listed servers, writes approvals to enabledMcpjsonServers, and loads the servers so their tools are available.

Error Messages/Logs

Steps to Reproduce

1. Create .mcp.json at the project root with one or more MCP server entries
2. Open a Claude Code session in that project directory
3. Observe: no permission prompt appears, no MCP tools are available

Claude Model

Sonnet (default)

Is this a regression?

I don't know

Last Working Version

_No response_

Claude Code Version

2.1.87

Platform

Anthropic API

Operating System

macOS

Terminal/Shell

Terminal.app (macOS)

Additional Information

• The remote-gateway SSE server was confirmed running at http://localhost:8000 at the time of testing
• EXA_API_KEY was set in the environment
• enabledMcpjsonServers was manually populated as a workaround after no prompt appeared — this did not resolve the issue
• The normal discovery flow (detect → prompt → write approval → load) never fired at any point
• Debug logs in ~/.claude/debug/ contain no MCP-related entries confirming connection was never attempted — this is a discovery failure, not a connectivity or auth failure