MCP connections return 503 DNS cache overflow from sandbox egress proxy (web/mobile)

Description

MCP tool connections from Claude Code web/mobile sessions fail with HTTP 503. The TLS certificate on the connection reveals traffic is being intercepted by Anthropic's own egress proxy (sandbox-egress-production TLS Inspection CA), and the HTTP response body is DNS cache overflow. The upstream MCP server (AWS Lambda function URL) is confirmed healthy and returns correct responses when accessed directly.

Steps to reproduce

1. Configure an MCP server using a Lambda function URL (or any external HTTPS endpoint)
2. Connect via Claude Code web or mobile
3. Observe 503 responses from MCP tool calls

Expected behavior

MCP calls reach the upstream server and return valid responses.

Actual behavior

HTTP 503 with body DNS cache overflow returned by the sandbox egress proxy before the request reaches the upstream server.

Evidence

< HTTP/2 503
< content-type: text/plain
DNS cache overflow

* SSL cert issuer: O=Anthropic; CN=sandbox-egress-production TLS Inspection CA

Impact

All MCP servers requiring outbound HTTPS are broken from web/mobile Claude Code. Claude Code desktop CLI is unaffected (bypasses the sandbox proxy and connects directly).

Environment

• Claude Code web/mobile (sandbox-hosted)
• MCP transport: Streamable HTTP
• Upstream: AWS Lambda function URL (us-east-2)
• Source IP: 160.79.106.35