Analyzed: March 31, 2026 leak snapshot
Claude Code is acting as an MCP client here. External MCP servers extend the agent’s capability surface and should be treated as code execution or privileged data access boundaries, not as passive documentation plugins.

​
Role of MCP in Claude Code

MCP is the mechanism Claude Code uses to attach external tool and resource providers to the local agent runtime. In source, MCP support is not an add-on. It is wired into:
  • Session startup
  • Tool registration
  • Slash command registration
  • Resource browsing
  • Auth and re-auth flows
  • Dynamic reconnect and toggle operations
The main implementation lives under src/services/mcp/.

​
Claude Code’s MCP model

Claude Code treats MCP servers as first-class runtime inputs. Each connected server can contribute:
  • Tools
  • Prompt-like commands
  • Skills
  • Resources
Those are then folded into the same app state used by built-in tools and commands.

​
Supported transport and config shapes

The schema in src/services/mcp/types.ts includes these server forms:
  • stdio
  • sse
  • http
  • ws
  • sdk
  • Internal IDE-specific variants
  • A Claude.ai proxy server type
That is broader than a minimal stdio-only MCP client.

​
Configuration scopes

The source distinguishes several scopes for MCP config:
  • local
  • user
  • project
  • dynamic
  • enterprise
  • claudeai
  • managed
This matters because Claude Code merges multiple config sources, tracks provenance, and can make different policy decisions based on where a server came from.

​
Config file locations visible in source

The most explicit file locations visible in source are:
  • Project-local .mcp.json in the current working directory
  • Managed enterprise file managed-mcp.json under the managed settings path
  • Global and project config objects that also carry mcpServers
src/services/mcp/config.ts contains the writer for .mcp.json, and src/utils/config.ts shows both project and global config types carrying MCP server records.
The exact on-disk locations of global and managed settings depend on helper functions such as getGlobalConfig(), getManagedFilePath(), and related environment utilities. The broad storage model is clear in source; some path details are indirect in this snapshot.

​
Merge and dedup behavior

MCP config merging is not name-based only. src/services/mcp/config.ts computes content signatures so it can detect duplicates by:
  • stdio command plus args
  • remote URL, with special handling for CCR proxy rewrites
Manual configuration wins over plugin-provided servers. Between plugins, earlier-loaded servers win. That is a practical safeguard against double-registering the same endpoint through different distribution channels.

​
Connection state model

src/services/mcp/types.ts models servers as one of:
  • connected
  • failed
  • needs-auth
  • pending
  • disabled
This state is carried in app state, not buried inside a transport class. That makes it available to UI surfaces like /mcp and to runtime reconnection logic.

​
Tool and command normalization

MCP contributions are normalized into Claude Code naming conventions. Tools:
  • Are exposed with an mcp__<server>__<tool> prefix model
  • Can be filtered or removed by server name
Commands:
  • May appear as mcp__<server>__<prompt>
  • MCP skills may use <server>:<skill>
The cleanup helpers in src/services/mcp/utils.ts have to account for both naming schemes.

​
Auth flow

src/services/mcp/client.ts contains explicit auth error handling, including:
  • OAuth-aware connection logic
  • 401 refresh and retry support
  • auth-needed server states
  • dedicated reconnect and clear-auth flows
There is also an McpAuthTool, which means auth is not treated as purely out-of-band UI.

​
Runtime lifecycle

At a high level, the MCP lifecycle looks like this:

​
Why this matters for security

An MCP server in Claude Code can do more than answer lookups. It can:
  • Expand the tool catalog the model can call
  • Add commands and skills
  • Return resources that become prompt context
  • Trigger auth and reconnect flows
That makes MCP effectively a plugin and trust boundary system, even when the transport is just remote HTTP.

​
/mcp command behavior

The slash command entry in src/commands/mcp/index.ts is a local-jsx command used to manage servers. Visible behaviors in source include:
  • Open the MCP settings UI
  • Reconnect a named server
  • Enable or disable one server or all servers
The UI is not just informational. It actively changes runtime state.

​
Practical reading of the code

If you are exploring MCP internals, the highest-value files are:
  • src/services/mcp/types.ts
  • src/services/mcp/config.ts
  • src/services/mcp/client.ts
  • src/services/mcp/utils.ts
  • src/commands/mcp/index.ts
That set covers schema, persistence, transport, normalization, and operator controls.