claude.ai connector MCP server names differ by entrypoint: `claude_ai_<name>` in CLI vs connection UUID in desktop — breaks subagent `tools:` and permission rules

Summary

The same claude.ai connector mounts under two different MCP server names depending on the session entrypoint:

| Entrypoint | Server name | Example tool name |
|---|---|---|
| CLI (entrypoint: cli) | claude_ai_<sanitized-display-name> | mcp__claude_ai_xavi-brain__put_page |
| Desktop app (entrypoint: claude-desktop) | connection UUID | mcp__432aae38-3236-4d88-8caa-e3b33eb27a1f__put_page |

Verified on the same day, same version (2.1.209), same account, same connectors: a CLI session and a desktop session mounted the identical connector set under the two different schemes. The desktop app's main.log shows connectors registered as dynamic-scope MCP servers whose name is the connection UUID (observed since at least 2026-05-11):

[LocalAgentModeSessionManager] mcpServerStatus returned 45 servers (28 with tools): [
  { "name": "432aae38-3236-4d88-8caa-e3b33eb27a1f", "status": "connected", "scope": "dynamic", "toolCount": 38 },
  ...

Why it hurts

1. Subagent tools: frontmatter breaks silently. Frontmatter requires exact tool names (no wildcards). A subagent scoped to a connector's tools (e.g. tools: Read, Grep, mcp__claude_ai_xavi-brain__put_page, ...) works in CLI sessions but silently loses all its MCP tools in desktop sessions — it starts with only the built-in tools that matched. There is no warning anywhere; we only noticed because the agent's writes stopped happening. The only workaround is duplicating every tool under both prefixes in the frontmatter.
2. permissions.allow rules never match in desktop. Rules like mcp__claude_ai_<name>__* are dead in desktop sessions, causing unexpected permission prompts. Users must duplicate every rule as mcp__<uuid>__* — which works, but is undiscoverable.
3. The UUID is not exposed anywhere user-facing. claude mcp list / claude mcp get print only the display name (related: #43389). The UUID has to be dug out of session transcripts (~/.claude/projects/**/*.jsonl) or the desktop main.log.

Repro

1. Configure any connector in claude.ai → Settings → Connectors.
2. Create ~/.claude/agents/foo.md with tools: Read, mcp__claude_ai_<name>__<some_tool>.
3. Spawn the agent from a CLI session → tool granted. Spawn it from a desktop-app session → agent has only Read.
4. Compare tool names across transcripts: sessions with "entrypoint":"cli" list mcp__claude_ai_<name>__*; sessions with "entrypoint":"claude-desktop" list mcp__<uuid>__* for the same connectors.

Expected

One stable server name per connector across all entrypoints — ideally the sanitized display name (or the short deterministic names proposed in #22276). Failing that, at minimum:

• document the UUID naming scheme and expose the UUID in claude mcp get (#43389), and
• support a user-defined alias so subagent frontmatter and permission rules can reference a connector portably.

Environment

• Claude Code 2.1.209 / 2.1.210, macOS (darwin 25.5.0)
• Related issues: #22276 (connector UUIDs vs 64-char tool-name budget), #43389 (expose connector UUIDs in CLI)