Project-scoped MCP servers don't trigger approval prompt
Resolved 💬 11 comments Opened Oct 9, 2025 by cfdude Closed Feb 6, 2026
Bug Report: Project-scoped MCP servers don't trigger approval prompt
Summary
When starting a Claude Code session in a project containing .mcp.json, the expected approval prompt for project-scoped MCP servers never appears. Users must manually create .claude/settings.local.json to enable servers, bypassing the intended security workflow.
Expected Behavior
- Start Claude Code session in project with
.mcp.json - Approval prompt appears: "This project wants to use MCP servers: [list]. Approve?"
- On approval,
.claude/settings.local.jsonis automatically created with enabled servers - Servers become available in
/mcp
Actual Behavior
- Start Claude Code session in project with
.mcp.json✅ - No approval prompt appears ❌
.claude/settings.local.jsonis NOT created ❌- Servers do NOT appear in
/mcplist ❌ - Must manually create
.claude/settings.local.jsonwithenabledMcpServersarray
Steps to Reproduce
- Create project directory
- Add
.mcp.jsonwith MCP server configurations:
{
"mcpServers": {
"google-workspace": {
"command": "uv",
"args": ["--directory", "/path/to/server", "run", "main.py"],
"env": { ... }
}
}
}
- Start Claude Code session in project:
claude code - Expected: Approval prompt appears
- Actual: No prompt, servers not available
Observed Issues
claude mcp listdoes NOT show project-scoped servers from.mcp.json- No approval prompt at session start
- No indication that
.mcp.jsonwas even detected - Possible conflict when same-named servers exist in user-scoped config
Environment
- OS: macOS Darwin 25.0.0
- Claude Code CLI (latest)
.mcp.jsonexists in project root with valid configuration
Workaround
Manually create .claude/settings.local.json:
{
"enabledMcpServers": ["google-workspace", "mcp-datetime"]
}
Impact
- Breaks documented security model for project-scoped MCP servers
- Users unaware of
.claude/settings.local.jsonrequirement - No visibility into which servers are project vs user-scoped
- Approval mechanism completely non-functional
Suggested Fixes
- Critical: Trigger approval prompt on session start when
.mcp.jsondetected - Add
--verboseflag to show MCP server discovery/loading process - Show scope indicators in
claude mcp list(user/project/local) - Warn when project servers conflict with user-scoped servers
- Document
.claude/settings.local.jsonapproval mechanism clearly
This issue has 11 comments on GitHub. Read the full discussion on GitHub ↗