[BUG] Cowork local MCPB calls fail with -32003 without approval UI, even in Skip mode

Preflight Checklist

• [x] I have searched existing issues and this hasn't been reported yet
• [x] This is a single bug report (please file separate reports for different bugs)
• [x] I am using the latest version of Claude Code

What's Wrong?

In Claude Desktop on Windows, an interactive Cowork task can discover tools from an enabled local Node MCPB connector, but every invocation fails immediately with:

MCP error -32003: MCP tool call requires approval

No approval prompt or approval card appears anywhere. The failure also occurs when the Cowork task is set to Skip all approvals.

The same packed MCPB works end-to-end when invoked from Claude Code CLI on the same PC.

The affected tools include a zero-argument health check and a navigation tool. Both are annotated with readOnlyHint: true, destructiveHint: false, and openWorldHint: true.

What Should Happen?

According to the Cowork permission documentation:

• Manual mode + Needs approval should display an approval prompt.
• Skip mode + Needs approval should allow execution.

A raw approval error without an actionable prompt should not occur in either mode, and an accepted Cowork tool call should be dispatched to the connected local MCP server.

Documentation: https://support.claude.com/en/articles/13345190-get-started-with-claude-cowork

Error Messages/Logs

MCP error -32003: MCP tool call requires approval

Sanitized audit sequence (JST):
- Permission mode changed to bypassPermissions.
- The dynamic remote-devices MCP tool decision was recorded as accept.
- 77–96 ms later, the call returned -32003.
- No approval UI appeared.

Desktop/local-server evidence:
- The local MCP process was running and connected.
- The local server received initialize and tools/list.
- It did not receive tools/call for any failed invocation.
- Desktop logs show the local MCP bridge announced all 8 tools and the remote-tools device connection authenticated.
- No local tool-completion event followed the failed attempts.

Account IDs, organization IDs, device names, task identifiers, and local paths are intentionally omitted.

Steps to Reproduce

1. On Windows 11 with Claude Desktop 1.24012.11.0, install and enable a local Node MCPB.
2. Expose a zero-argument health tool and another read-only tool. Annotate both with:

{ readOnlyHint: true, destructiveHint: false, openWorldHint: true }

1. In the connector's tool-permission settings, leave both tools set to Needs approval.
2. Start an interactive Cowork task.
3. Set the task permission mode to Skip all approvals.
4. Ask Cowork to invoke either tool.
5. Observe MCP error -32003: MCP tool call requires approval with no approval UI.
6. Repeat in Manual mode. The raw error still appears and no prompt is rendered.
7. Invoke the same packed MCPB health tool from Claude Code CLI on the same PC. It succeeds.

Claude Model

Opus

Is this a regression?

I don't know

Last Working Version

Unknown; related routine approval regressions were previously reported as fixed

Claude Code Version

2.1.201 (Claude Code) — comparison control; affected product is Claude Desktop 1.24012.11.0

Platform

Anthropic API

Operating System

Windows

Terminal/Shell

PowerShell

Additional Information

Connector environment

• OS: Windows 11
• Claude Desktop: 1.24012.11.0
• Surface: interactive Cowork task
• Connector: local Node MCPB
• MCPB manifest: 0.4
• Connector package: 0.4.1
• MCP SDK: @modelcontextprotocol/sdk 1.30.0

Isolation performed

• Source, packaged MCPB, and installed files have matching SHA-256 hashes.
• MCPB manifest validation passes.
• Package tests pass (13/13).
• A direct MCP smoke test succeeds and lists all 8 tools.
• The actual tools/list response contains the expected annotations.
• The server contains no approval enforcement and no -32003 error path.
• Tool descriptions did not change between the preceding and current patch release, ruling out a new tool-description approval hash.
• Claude Code CLI successfully invokes the same packed health tool.
• The failed Cowork calls never reach the local MCP server.

This strongly suggests a missing or unrecognized approval-context handoff between Cowork's dynamic remote-devices wrapper and the remote local-MCP approval gate, before Desktop dispatches tools/call.

Workaround

Setting each connector tool to Always allow, or using Claude Code CLI, avoids the failure. This is not adequate where organizational policy requires per-call approval for write tools.

Related

#61015, #61027, #61116, #61196, #29026, #5749, #8859

No screenshots are attached because the available screenshots contain organization and business-task information.