claude mcp add reports success when the config write is denied (sandboxed Bash)

Version: 2.1.273 and 2.1.274 (native, macOS arm64)

What happens

Run inside the Claude Code Bash tool with the sandbox enabled (sandbox.enabled: true), where ~/.claude.json is a protected write path:

claude mcp add --scope user sbx-probe-noop -- /usr/bin/true

Output:

Added stdio MCP server sbx-probe-noop with command: /usr/bin/true  to user config
File modified: /Users/<user>/.claude.json

Exit status 0. The server is not saved:

claude mcp get sbx-probe-noop   # -> No MCP server named "sbx-probe-noop"

Reproduced three times (2.1.273 twice, 2.1.274 once). claude mcp get exits 1.

Why

• Opening ~/.claude.json for writing (r+) from the sandbox fails with EPERM. Separately, a create-then-rename onto a different, non-existing protected path also failed with EPERM; rename onto ~/.claude.json itself was not tested, to avoid overwriting live config.
• Blocking is expected: the sandboxing docs say protected paths exist because a command "could … add a hook or MCP server that Claude Code runs outside the sandbox".
• The defect is the report. Possibly relevant, from reading the minified 2.1.273 bundle (names will differ across versions): the global-config save path catches the error, logs Failed to save config with lock: …, and returns false, and one wrapper has the form ….then(()=>{return}), which discards that result. The mcp add handler prints the success lines after await.
• I could not confirm that mcp add's save call goes through that wrapper; the observed behavior is consistent with it but this is not verified.

Expected

When the config write fails, claude mcp add should print an error (e.g. "Could not write ~/.claude.json: EPERM — run this outside the sandbox with !") and exit non-zero.

Workaround

Run claude mcp add via ! (outside the sandbox) and verify with claude mcp get <name>.

Search done

CHANGELOG.md full text: no entry about mcp add reporting success on a failed save. Issue search (claude.json sandbox mcp add, "File modified" claude.json not saved): 0 results.