[BUG] tool_search_tool_result references a claude.ai connector that was never enabled on the account — session 400s permanently and cannot compact

Preflight Checklist

• [x] I have searched existing issues. This is the same symptom as #78485, #79970, #80258, #82004, but a different root cause: in all of those the referenced tool was genuinely in the pool and then left it (plugin tool, agent-team dynamic tool, MCP disconnect, startup tool). Here the referenced tool was never in the pool at any point. #81863 is the same variant as this report (mcp__claude_ai_Indeed__get_company_data) but contains only error dumps and no diagnosis.
• [x] This is a single bug report
• [x] I am using the latest version of Claude Code

What's Wrong?

A tool_search_tool_regex result was persisted into session history containing a tool_reference to a claude.ai connector that has never been enabled on this account. Every subsequent request replays that reference and the API rejects the entire request:

API Error: 400 Tool reference 'mcp__claude_ai_Intuit_QuickBooks__qbo_accounting_get_ar_aging_summary' not found in available tools

I have never had the Intuit QuickBooks connector. Verified four ways:

1. Not in ~/.claude.json — the only local MCP server is an unrelated one.
2. It has never appeared in an "MCP Server Instructions" block in any transcript on this machine. The connectors actually declared to the session are Atlassian, Context7 and Hugging Face.
3. It is not present in the connector list on claude.ai — not enabled, not configured, not there at all.
4. Only one QuickBooks tool name has ever appeared in any transcript on this machine: the single one in the error. A genuinely installed connector would surface many distinct tool names.

So the tool-search index appears to be scoped to a global connector catalog rather than to the tools declared in the request.

The stored block (abridged, inner "type" fields removed for readability):

{"type":"tool_search_tool_result",
 "tool_use_id":"srvtoolu_01QbGSL97cSFjjz7pKeNbNSQ",
 "content":{"type":"tool_search_tool_search_result",
   "tool_references":[
     {"tool_name":"AskUserQuestion"},
     {"tool_name":"EnterPlanMode"},
     {"tool_name":"ExitPlanMode"},
     {"tool_name":"Workflow"},
     {"tool_name":"mcp__claude_ai_Intuit_QuickBooks__qbo_accounting_get_ar_aging_summary"}]}}

The preceding server_tool_use block is stored with "input": {}. The returned set also doesn't look like the answer to a coherent regex, which matches the observation in #79970 / #80258 that results include tools that don't match the search.

Second occurrence, different connector, different project. On 2026-08-10 a search returned Workflow, two Hugging Face tools and four blender-skills MCP tools — all genuinely present — plus mcp__claude_ai_Autodesk_Fusion_Data_MCP_Server__search_by_hub and …__similarity_search, another connector I have never enabled.

Together with #81863 (Indeed), that is three distinct connectors across two accounts, none of them installed.

What Should Happen?

1. Tool search should only return references to tools present in the request's tools array.
2. An unresolvable tool_reference in history should be dropped or ignored rather than rejecting the whole request. Today a single unresolvable name makes the session permanently unusable, and the user has no way to know which name is at fault without parsing the .jsonl by hand.
3. Compaction should survive it. This is what makes the failure terminal rather than annoying — compaction replays the same history and fails the same way:

Prompt is too long · automatic compaction failed: API Error: 400 Tool reference
'mcp__claude_ai_Intuit_QuickBooks__qbo_accounting_get_ar_aging_summary' not found in available tools

The session grows too long to continue and cannot compact its way out. There is no in-product recovery path.

Error Messages/Logs

API Error: 400 Tool reference 'mcp__claude_ai_Intuit_QuickBooks__qbo_accounting_get_ar_aging_summary' not found in available tools

Poisoned message id msg_011CdzS8hVaS3X7XkMndVhdi, server tool use id srvtoolu_01QbGSL97cSFjjz7pKeNbNSQ, timestamp 2026-08-13T08:30:30.052Z.

Steps to Reproduce

Not reproducible on demand, since it depends on what the search index returns. Observed twice in four days on this machine.

1. Run a session with tool search active.
2. Let the assistant issue a deferred-tool search (tool_search_tool_regex).
3. Inspect the resulting tool_search_tool_result for tool_references naming connectors that are not enabled on the account:

``
grep -o 'mcp__claude_ai_[A-Za-z0-9_]*' ~/.claude/projects/*/*.jsonl | sort -u
``

1. If any names a connector you do not have, that session will 400 on every subsequent request and cannot be compacted.

Workarounds

• Prevention: ENABLE_TOOL_SEARCH=auto:100 in ~/.claude/settings.json env forces standard mode, so no search is issued and no reference can be persisted. Costs the full tool catalog on every request, so it is a poor trade on a large tool surface. (Verified against the 2.1.229 mode selector: auto:100 → standard, auto:0 → tst, unset → tst.)
• Repair: remove the offending entry from the tool_references array in the session .jsonl while that session is not running. The session then resumes and compacts normally.

Neither is discoverable by a normal user — both require reading the transcript format or the bundle.

Regression?

Not sure.

Claude Code Version

2.1.229

Platform

Linux (VSCode extension). #81863 reports the same variant on 2.1.220, so it is not new in 2.1.229.