[BUG] MCP server instructions routing to subagents is inverted: absent for subagents with the server's tools, injected into subagents without them

Environment

• Claude Code version: 2.1.226
• Platform: Linux

Summary

The instructions string an MCP server returns at initialize reaches the main session, but its routing to background subagents is inverted: a subagent that inherits the server's MCP tools never receives the instructions, while a subagent with no MCP tools at all can have the same instructions injected mid-run, appended to an unrelated tool result. Both halves have been reported separately -- #29655 (bug-labeled with repro, auto-closed as stale with no maintainer reply) and #75283 (open) -- but no issue states the combined mechanism, and the docs are silent in both directions: sub-agents.md "What loads at startup" enumerates a non-fork subagent's initial context without mentioning server instructions on either the included or the excluded list (https://code.claude.com/docs/en/sub-agents#what-loads-at-startup), and mcp.md describes instructions only as loading "at session start" (https://code.claude.com/docs/en/mcp#scale-with-mcp-tool-search). The MCP spec leaves delivery to the client ("this information MAY be added to the system prompt"), so this is about Claude Code's own consistency, not spec conformance.

Observed

One session, one stdio MCP server (a fork of mozilla/firefox-devtools-mcp) declaring instructions in its Server options (TypeScript SDK 1.29.0). Same day, same connection:

• Main session: context contains a # MCP Server Instructions block with the server's text after the server connects.
• Subagent A (general-purpose; all 31 of the server's tools available as deferred names; 161 tool calls over 40 minutes): asked afterwards whether any connection-level server guidance ever surfaced -- "No. No server instructions, no recommended workflow, no resource listing. All guidance came from individual tool descriptions."
• Subagent B (general-purpose; zero tool calls; prompted to search its own context for the instructions' marker string): string absent, no MCP Server Instructions section or per-server preamble anywhere; all 31 mcp__<server>__* names present in its deferred-tools list.
• Subagent C (custom agent type with tools: Bash, Read, WebFetch, WebSearch -- no MCP tools; task unrelated to the server): received the full # MCP Server Instructions block for the server mid-run, appended to a tool result (wrapped in the harness's instruction-shaped-content warning), and flagged it in its report as steering text arriving from a channel that is neither its user nor its task.

The two agents that could call the server never saw its usage guidance; the one agent that could not call it had the guidance injected.

Expected

Instructions follow the tools. A subagent that inherits a server's MCP tools should receive that server's instructions -- they are the server's usage manual, and the server author has no other channel that reaches subagents (resources are also stripped, #85230). A subagent without the server's tools should never have them appended to its tool results: server instructions are server-authored text, so delivering them into the context of an agent that never opted into the server is an injection surface, exactly the concern #75283 raises.

Proposed fix

Deliver server instructions wherever the server's tools are delivered, and only there. Failing that, specify the actual behavior: sub-agents.md's "What loads at startup" should name server instructions on one of its two lists, and mcp.md should say what "session" means for subagents.

Related

• #29655 -- the missing half: subagents do not receive MCP server instructions; bug has repro area:mcp area:agents, auto-closed by the stale bot with no maintainer reply
• #75283 -- the injected half: subagent without MCP/ToolSearch gets parent-session MCP instructions appended to a Bash tool_result
• #58138 / #47118 -- same injection path tripping prompt-injection defenses
• #85230 -- sibling background-subagent context stripping (MCP resource tools), which is why tool descriptions are currently a server's only channel that reaches subagents