Project-scoped MCP servers don't trigger approval prompt

Resolved 💬 11 comments Opened Oct 9, 2025 by cfdude Closed Feb 6, 2026

Bug Report: Project-scoped MCP servers don't trigger approval prompt

Summary

When starting a Claude Code session in a project containing .mcp.json, the expected approval prompt for project-scoped MCP servers never appears. Users must manually create .claude/settings.local.json to enable servers, bypassing the intended security workflow.

Expected Behavior

  1. Start Claude Code session in project with .mcp.json
  2. Approval prompt appears: "This project wants to use MCP servers: [list]. Approve?"
  3. On approval, .claude/settings.local.json is automatically created with enabled servers
  4. Servers become available in /mcp

Actual Behavior

  1. Start Claude Code session in project with .mcp.json
  2. No approval prompt appears ❌
  3. .claude/settings.local.json is NOT created ❌
  4. Servers do NOT appear in /mcp list ❌
  5. Must manually create .claude/settings.local.json with enabledMcpServers array

Steps to Reproduce

  1. Create project directory
  2. Add .mcp.json with MCP server configurations:
{
  "mcpServers": {
    "google-workspace": {
      "command": "uv",
      "args": ["--directory", "/path/to/server", "run", "main.py"],
      "env": { ... }
    }
  }
}
  1. Start Claude Code session in project: claude code
  2. Expected: Approval prompt appears
  3. Actual: No prompt, servers not available

Observed Issues

  • claude mcp list does NOT show project-scoped servers from .mcp.json
  • No approval prompt at session start
  • No indication that .mcp.json was even detected
  • Possible conflict when same-named servers exist in user-scoped config

Environment

  • OS: macOS Darwin 25.0.0
  • Claude Code CLI (latest)
  • .mcp.json exists in project root with valid configuration

Workaround

Manually create .claude/settings.local.json:

{
  "enabledMcpServers": ["google-workspace", "mcp-datetime"]
}

Impact

  • Breaks documented security model for project-scoped MCP servers
  • Users unaware of .claude/settings.local.json requirement
  • No visibility into which servers are project vs user-scoped
  • Approval mechanism completely non-functional

Suggested Fixes

  1. Critical: Trigger approval prompt on session start when .mcp.json detected
  2. Add --verbose flag to show MCP server discovery/loading process
  3. Show scope indicators in claude mcp list (user/project/local)
  4. Warn when project servers conflict with user-scoped servers
  5. Document .claude/settings.local.json approval mechanism clearly

View original on GitHub ↗

This issue has 11 comments on GitHub. Read the full discussion on GitHub ↗