[BUG]

Preflight Checklist

• [x] I have searched existing issues and this hasn't been reported yet
• [x] This is a single bug report (please file separate reports for different bugs)
• [x] I am using the latest version of Claude Code

What's Wrong?

What's Wrong?

Custom .mcpb files uploaded to an organization's desktop extension allowlist cannot be installed by members of that organization. The Install button is disabled with the tooltip "This extension cannot be installed. Contact your organization owner," even when the user is double-clicking the exact byte-identical .mcpb file that was uploaded to the allowlist.

Root cause looks like an extension-ID derivation mismatch between the server-side allowlist and the client-side installer. The two compute different IDs for the same .mcpb, so the allowlist match always fails.

Workaround

Disable the org's desktop extension allowlist enforcement. Install works. Re-enabling enforcement breaks the extension again on the next allowlist refresh. This isn't viable for any real org rollout — losing allowlist enforcement defeats the security posture the feature exists to provide.

Suggested fixes (any one would unblock)

1. Server and client agree on the same ID derivation algorithm for custom uploads.
2. Allowlist matching keyed on content hash (SHA256 of the .mcpb) instead of ID. The hash already gets stored client-side in extensions-installations.json, so the plumbing exists.
3. Expose an explicit top-level id field in manifest 0.4 so authors can pin the ID and both sides respect it.

Environment

• OS: macOS (Apple Silicon)
• Claude Desktop: 1.7196.0
• Manifest version in .mcpb: 0.3
• Account plan: Pro (org admin)

Note on repo selection

This is a Claude Desktop bug, not a Claude Code CLI bug. Anthropic support directed me here. Please redirect to the appropriate Desktop tracker if one exists.

What Should Happen?

Expected

Install button is active. Extension installs and runs when the org is the active account.

Actual

Install button is greyed out. Tooltip: "This extension cannot be installed. Contact your organization owner."

Root cause (likely)

The server-side allowlist and the local client compute different IDs from the same .mcpb:

• Server-side ID (registered when uploaded to org allowlist): {name}-{version} → custom-mcp-server-1.1.5
• Client-side ID (assigned at local install): local.mcpb.{author-slug}.{name} → local.mcpb.acmecorp.custom-mcp-server

Allowlist matching is keyed on ID, so it never matches even though the file content is identical (SHA256 confirmed matching between the file on disk and the file uploaded to the allowlist).

Error Messages/Logs

### Supporting evidence

During an earlier broken state of this setup (before uninstall/reinstall), the in-app error toast read literally:

> Manifest file not found for extension: `custom-mcp-server-1.1.5`

That's the server-assigned ID. The client was looking on disk for an extension dir named after the server's ID, didn't find it (because the local install dir uses the client's ID format), and refused to enable the extension.

Inspecting `~/Library/Application Support/Claude/Claude Extensions Settings/` during the broken state revealed three settings files — one per ID the client had been confused about:


ant.dir.gh.acmecorp.custom-mcp-server.json          # legacy directory install
local.mcpb.acmecorp.custom-mcp-server.json          # current local install
custom-mcp-server-1.1.5.json                        # phantom, server-ID-shaped


Only the second of those had a matching directory in `Claude Extensions/`. The third was the server's view of what should have been installed, with no on-disk install to back it.

Steps to Reproduce

1. Build a custom .mcpb with manifest_version: "0.3" and no top-level id field. Example manifest fields: name: custom-mcp-server, version: 1.1.5, author.name: AcmeCorp.
2. In the org admin UI: Settings → Connectors → Add desktop extensions → upload the .mcpb.
3. Toggle Desktop extension allowlist enforcement on.
4. As a member of that org, on macOS, double-click the same .mcpb to install.

Claude Model

None

Is this a regression?

I don't know

Last Working Version

_No response_

Claude Code Version

2.1.138 (Claude Code)

Platform

Anthropic API

Operating System

macOS

Terminal/Shell

Terminal.app (macOS)

Additional Information

_No response_