Subagent explicit tools: allowlist silently collapses (drops ToolSearch + all MCP tools) when MCP server is unavailable at spawn

Environment

• Claude Code 2.1.208 (native install, macOS / darwin 25.5.0, Claude Code desktop app sessions)
• Custom project subagents under .claude/agents/*.md with explicit tools: allowlists that mix built-ins, ToolSearch, and MCP tool names (Playwright MCP via a plugin)

Summary

A subagent whose tools: frontmatter explicitly lists ToolSearch plus MCP tool names can spawn with a silently degraded grant: all MCP entries AND ToolSearch missing, with no warning to the spawning session or the subagent. The same agent definition, same binary, gets the full grant in other sessions. The behaviour appears to depend on MCP server availability at the moment of spawn.

Agent definition (abridged)

name: qa
model: opus
tools: Read, Write, Glob, Grep, Bash, WebSearch, ToolSearch, mcp__plugin_playwright_playwright__browser_navigate, mcp__plugin_playwright_playwright__browser_snapshot, mcp__plugin_playwright_playwright__browser_click, mcp__plugin_playwright_playwright__browser_type, mcp__plugin_playwright_playwright__browser_press_key, mcp__plugin_playwright_playwright__browser_wait_for, mcp__plugin_playwright_playwright__browser_resize, mcp__plugin_playwright_playwright__browser_take_screenshot, mcp__plugin_playwright_playwright__browser_evaluate

Observed

Healthy session (fresh, 2026-07-21): the subagent reports loaded Read, Write, Bash, ToolSearch + deferred WebSearch + the 9 Playwright tools; ToolSearch select:mcp__plugin_playwright_playwright__browser_navigate loads the schema. Works as intended.

Degraded session (2026-07-20/21, same binary — 2.1.208 installed since Jul 14): the same subagent, probed twice, reports its entire toolset as Read, Write, Bash, WebSearch — no ToolSearch, no MCP tools, no deferred list. It cannot reach the browser at all. No error or warning surfaced anywhere; the spawning session only finds out when the subagent's task output comes back browserless.

In the degraded session, a general-purpose subagent (tools: *) spawned moments apart could load the same Playwright schema via ToolSearch — so the MCP server was connected and serving from the harness's perspective at least part of the time.

Inferred mechanism (from the grant shapes)

The degraded set is exactly what you'd get if the explicit allowlist is resolved once at spawn against currently-available tools: with the Playwright server unavailable at that instant, the MCP entries drop, the deferred set becomes empty, ToolSearch is then omitted (nothing to search), and WebSearch is loaded directly instead of deferred → Read, Write, Bash, WebSearch. A tools: * agent instead resolves deferred tools live at ToolSearch time, which is why it survives. The degraded session also had Playwright browser-profile contention (Browser is already in use … use --isolated), which may be what made the server intermittently unavailable.

Expected

Either (a) the spawn fails/warns loudly when explicitly-listed tools can't be granted, or (b) unavailable MCP tools stay in the deferred list so a later ToolSearch can pick them up once the server recovers — matching the tools: * behaviour. Silent partial grants make an agent's contract unenforceable: our QA walk agents correctly refuse to give verdicts without a browser, so the failure surfaces as mysterious refusals far downstream.

Related observation — allowlist entries silently stripped even in healthy sessions

Verified with live calls in a healthy session (same binary):

• Agents declaring Glob, Grep alongside Bash get neither — not loaded, not deferred; ToolSearch select:Glob,Grep returns "No matching deferred tools found". An agent with Glob, Grep but no Bash gets both. Looks like a "Bash subsumes Glob/Grep" dedup.
• AskUserQuestion is stripped from background subagent runs (defensible, but undocumented).

If these are intentional, documenting them on the subagent tools: frontmatter would help — right now the declared allowlist and the actual grant diverge with no signal.

Repro

Not deterministic — the collapse is transient and appears tied to MCP-server state at spawn. Steady state: define an agent like the above, spawn it, have it report its toolset; the degraded form was observed twice in one session and never in a fresh one. Happy to provide more detail from the affected sessions.