Managed/team-seat config bypasses MCP tool-search deferral — claude.ai connector schemas re-inject into messages every turn (CC 2.1.158)

Summary

In a managed / team-seat configuration, claude.ai MCP connector tool schemas are injected into the messages array on every user turn and accumulate — instead of being deferred. On an unmanaged machine running the same Claude Code version (2.1.158), the same connector type defers correctly (schemas load on-demand; only names at startup). The result is 60%+ of the context window consumed before any real work on a managed seat, growing ~20K tokens per turn, forcing mid-task compaction.

This does not appear to be a missing-feature request — tool-search deferral already exists and works. The issue is that it seems to be bypassed under managed config.

Environment

• Claude Code 2.1.158 (identical on both machines compared below)
• Managed/team-seat machine: several connected claude.ai connectors (Notion, Slack, Atlassian, Figma, Gmail, Granola, Lucid, Google Drive)
• Unmanaged personal machine: claude.ai connectors (Linear, Google Drive, Indeed)

Reproduction

1. Claude Code 2.1.158 on a managed/team seat with several connected claude.ai connectors.
2. Open any project, type a single word ("hello"), run /context.
3. Messages is far larger than the conversation, and climbs ~20K tokens with each additional turn.

Measured control data (cause isolated)

Same CC version (2.1.158) on both:

| Environment | Connectors | Behavior |
|---|---|---|
| Unmanaged | Linear, Drive, Indeed (claude.ai) | Deferred — schemas load on-demand; ~0 in Messages |
| Unmanaged + Slack added (isolation test) | + Slack — the same connector that bloats the managed seat | Deferred — entered the deferred catalog once, no per-turn schema injection across the session |
| Managed / team seat | Notion, Slack, Atlassian, Figma, Gmail, Granola, Lucid, Drive | Re-injected every turn, accumulating: Messages 1.7K idle → 24.6K (turn 1) → 42.2K (turn 2), ~+20K/turn |

Isolation: version is ruled out (both 2.1.158); the connector type is provably defer-able; the same Slack connector defers when unmanaged but injects ~10.7K/turn when managed. The only remaining differentiator is the managed/team-seat environment.

Why this is hard to diagnose

1. /context shows MCP tools at 0 tokens (deferred listing), while the actual schema cost lands unattributed in the Messages bucket — a user sees 100K+ in Messages with no indication it's MCP schemas.
2. The full schemas come from remoteMcpServersConfig (a field present in ~/Library/Application Support/Claude/claude-code-sessions/*/local_*.json) and are injected at the API layer — not stored in the session transcript JSONL (its mcp_instructions_delta records are truncated). Measuring the JSONL misses the source entirely.

Requested fixes

1. Primary: make managed/team-seat sessions honor the tool-search deferral that unmanaged sessions already apply to claude.ai connectors — i.e., stop injecting full connector schemas into messages per turn.
2. Visibility: add a dedicated "Remote MCP schemas" line to /context so this cost is attributable rather than hidden inside Messages.
3. Secondary: per-tool allow-listing for connectors in settings.json (today only server-level allowedMcpServers/deniedMcpServers exist), so a user who needs only e.g. notion-search/notion-fetch need not carry the write-tool schemas.
4. Stop truncating mcp_instructions_delta entries in session JSONL so the injection size is auditable from session history.

Workaround

deniedMcpServers in project .claude/settings.json for unused connectors drops the per-turn rate (denying 6 of 8 connectors → ~50K/turn → ~20K/turn). It is lossy — server-level only, so useful connectors are lost entirely. /compact reclaims already-accumulated schema (it collapses the duplicated history blocks), so compacting at the start of a long run helps.

Related issues (not duplicates)

• #23787 (lazy-load MCP tool schemas) — closed; deferral shipped and works for unmanaged sessions. This issue is that managed mode doesn't get it.
• #7172 (MCP token management) — closed, general.
• #39624, #61594 — docs issues on deniedMcpServers / allowAllClaudeAiMcps behavior for claude.ai connectors.