[BUG] --strict-mcp-config with empty --mcp-config still fetches MCP registry and attempts user-configured servers

Title

[BUG] --strict-mcp-config with empty --mcp-config still fetches MCP registry from api.anthropic.com and attempts user-configured MCP servers

Preflight Checklist

• [x] I have searched existing issues and this hasn't been reported yet
• [x] This is a single bug report
• [x] I am using the latest version of Claude Code

What's Wrong?

The --help text for --strict-mcp-config reads:

"Only use MCP servers from --mcp-config, ignoring all other MCP configurations"

When --strict-mcp-config is combined with an explicitly empty server list (--mcp-config '{"mcpServers":{}}'), the expected behavior is that no MCP discovery or connection attempts happen. Observed behavior:

1. Hits https://api.anthropic.com/v1/mcp_servers?limit=1000 to fetch a server list, then
2. Loads a 197-URL legacy MCP registry, and
3. Attempts to connect to user-configured MCP servers from ~/.claude/settings.json, each failing with mcp_unauthorized_no_token after 250-620 ms.

In -p (print/batch) mode this is wasted wall-clock per invocation — ~200ms from the api.anthropic.com fetch plus ~1.2s cumulative from the three failed user-MCP connection attempts. For procedural calls (e.g. ranking per function/file quality for refactoring), repeated calls accrue substantial wall-clock time and extra network traffic.

What Should Happen?

With --strict-mcp-config --mcp-config '{"mcpServers":{}}':

• No HTTP requests to api.anthropic.com/v1/mcp_servers (or any other MCP discovery endpoint).
• No connection attempts on user-configured MCP servers from ~/.claude/settings.json or other settings sources.
• "Only use MCP servers from --mcp-config" should be interpreted as written — an empty mcpServers map means no MCP servers.

Error Messages/Logs

2026-05-18T13:46:46.389Z [DEBUG] [STARTUP] Loading MCP configs...
2026-05-18T13:46:46.565Z [DEBUG] [STARTUP] MCP configs resolved in 1ms (awaited at +176ms)
2026-05-18T13:46:46.603Z [DEBUG] [claudeai-mcp] Fetching from https://api.anthropic.com/v1/mcp_servers?limit=1000
2026-05-18T13:46:46.819Z [DEBUG] [claudeai-mcp] Fetched 3 servers
2026-05-18T13:46:46.980Z [DEBUG] [mcp-registry] Loaded 197 official MCP URLs (legacy)

When run with a sandboxed HOME containing only .claude/.credentials.json (no settings.json), the user-MCP attempts don't appear — confirming they originate from ~/.claude/settings.json. But the api.anthropic.com/v1/mcp_servers fetch happens regardless, even with --strict-mcp-config set:

2026-05-18T13:45:45.782Z [DEBUG] MCP server "claude.ai Google Drive": claude.ai proxy connection failed after 264ms: Streamable HTTP error: ...
2026-05-18T13:45:45.822Z [DEBUG] MCP server "claude.ai Google Calendar": claude.ai proxy connection failed after 301ms: Streamable HTTP error: ...
2026-05-18T13:45:46.137Z [DEBUG] MCP server "claude.ai Gmail": claude.ai proxy connection failed after 617ms: Streamable HTTP error: ...

Steps to Reproduce

SBX=$(mktemp -d)
mkdir -p "$SBX/.claude"
ln -s "$HOME/.claude/.credentials.json" "$SBX/.claude/.credentials.json"

HOME="$SBX" claude -p \
  --strict-mcp-config \
  --mcp-config '{"mcpServers":{}}' \
  --disable-slash-commands \
  --model claude-sonnet-4-6 \
  --no-session-persistence \
  --output-format json \
  --system-prompt 'You are an auditor. Reply OK.' \
  --debug-file /tmp/cc-mcp.log \
  <<< 'ping' > /tmp/cc-mcp.out

# Look for MCP fetches that should not happen.
grep -iE 'claudeai-mcp|mcp-registry|fetching from' /tmp/cc-mcp.log

# Without the sandbox HOME, also observe user-MCP connection attempts:
claude -p \
  --strict-mcp-config \
  --mcp-config '{"mcpServers":{}}' \
  --model claude-sonnet-4-6 \
  --no-session-persistence \
  --output-format json \
  --system-prompt 'You are an auditor. Reply OK.' \
  --debug-file /tmp/cc-mcp-real.log \
  <<< 'ping' > /tmp/cc-mcp-real.out
grep -iE 'mcp.*failed|claude\.ai' /tmp/cc-mcp-real.log

rm -rf "$SBX"

Claude Model

Sonnet (default). Not model-specific; MCP discovery is independent of model choice.

Is this a regression?

I haven't tested older versions.

Last Working Version

N/A.

Claude Code Version

2.1.133 (Claude Code)

Platform

Anthropic API

Operating System

Devcontainer, Linux 6.12.76-linuxkit, ARM, on M-series Mac.

Terminal/Shell

Bash inside vscode

Additional Information

Roughly 200-1400 ms of wall-clock latency per claude -p invocation, depending on whether the user has claude.ai MCP servers configured. For procedural calls this is unavoidable overhead the caller cannot disable via documented flags.

The startup line says MCP configs resolved in 1ms (awaited at +176ms) — that 1ms is the static config parse, but the +176ms includes the claudeai-mcp and mcp-registry fetches that fire after config resolution. It would be good to gate those fetches on strictMcpConfig.