Remote (Cowork) runner loads all plugins unconditionally — no per-session MCP allowlist; causes OOM on multi-session machines

Feature Request: per-session / per-project MCP plugin allowlist for the remote (Cowork) runner

Product: Claude Code — remote/Cowork runner (ccd-cli)
Version observed: 2.1.181 (also 2.1.170, 2.1.177 present)
Platform: macOS (Apple Silicon, M4 Pro Mac mini, 24 GB RAM)
Category: resource usage / configurability

Summary

The remote/Cowork runner launches every session with all installed plugin directories
loaded unconditionally (observed: 76 --plugin-dir flags spanning 132 dirs under
~/.claude/remote/plugins/). Plugins that declare MCP servers therefore all spawn per
session, regardless of whether the session needs them. There is no exposed configuration to
restrict which plugins/MCP servers a remote session loads.

enabledPlugins in ~/.claude/settings.json does not gate the remote runner — verified:
setting heavy plugins to false there did not prevent their MCP servers from spawning in a
fresh ccd-cli session. So today there is no user-facing knob for this on the remote runner.

Impact (measured)

Per session, the MCP swarm is ~2.3 GB RSS. Heavy servers observed and their cost:

• endorctl (ai-tools): ~949 MB
• desktop-commander: ~514 MB
• prisma: ~475 MB
• firebase: ~373 MB
• server-pdf: ~249 MB
• pinecone: ~142 MB (legitimately needed — FS index)
• cloudinary: needed — image delivery

With multiple concurrent Cowork sessions (each spawning the full swarm), a 24 GB machine hits
vm-compressor-space-shortage jetsam kills. We confirmed 2 concurrent sessions ≈ 5 GB of MCP
servers; a 3rd session or a transient app/VM spike tips the box into OOM. Most of the per-session
cost is plugins the session never uses (e.g. a Next.js/Supabase project does not need Prisma,
Firebase, or a PDF server).

Note: servers correctly exit on clean session end, and we run a watchdog/reaper for orphans —
so this is not a leak. It is unconditional loading: there is no way to say
"this session/project only needs supabase, vercel, linear, context7, pinecone."

Requested capability

A way to scope which plugins / MCP servers the remote runner loads, e.g. one of:

1. Honor enabledPlugins (or a new enabledMcpServers) for the remote runner, not just local.
2. A per-project .claude/ plugin/MCP allowlist the remote session respects.
3. Lazy / on-demand MCP server startup — spawn a server only when its tools are first invoked,

and shut it down when idle. (This best matches the intuitive expectation: "load only when a
session needs them, close when done.")

Any of these would cut per-session footprint from ~2.3 GB to ~0.5 GB and remove the dominant
cause of OOM on memory-constrained orchestration machines running multiple Cowork sessions.

Repro

1. macOS, install many MCP-bearing plugins.
2. Start 2+ concurrent Cowork/remote sessions.
3. ps -axo rss,command | grep -iE 'mcp|_npx' → full swarm × N sessions.
4. Set the heavy plugins false in ~/.claude/settings.json enabledPlugins, start a fresh

remote session → MCP servers still spawn (the setting is not honored by the remote runner).

Workaround in place

Disabled an unrelated CPU hog (CuaDriver) + fixed a headless-Chrome leak + added a memory
watchdog with reaper and alerting. These mitigate but do not address the per-session swarm,
which has no supported config control today.