Bug: disabledMcpServers setting not enforced at session startup

[bitr8]

Bug: disabledMcpServers setting not enforced at session startup

Environment

• Claude Code version: 2.0.61
• OS: Fedora 43 (Linux 6.17.9)
• Shell: bash

Description

MCP servers listed in disabledMcpServers are not actually disabled when starting a new Claude Code session. The setting is persisted correctly in ~/.claude.json and the /mcp command shows them as disabled, but Claude can still connect to and use all the servers.

Steps to Reproduce

1. Configure MCP servers globally in ~/.claude.json:

{
  "mcpServers": {
    "pixellab": { ... },
    "leonardo-ai": { ... },
    "gemini-cli": { ... },
    "chrome-devtools": { ... },
    "codex-cli": { ... }
  }
}

2. Add all servers to disabledMcpServers for a project (either via /mcp toggle or programmatically):

{
  "projects": {
    "/home/rob/Projects/ziggurat": {
      "disabledMcpServers": [
        "leonardo-ai",
        "pixellab",
        "gemini-cli",
        "chrome-devtools",
        "codex-cli"
      ]
    }
  }
}

3. Start a new Claude Code session in that project directory

4. Run /mcp - shows all servers as disabled (correct)

5. Ask Claude to check MCP server status with claude mcp list

Expected Behavior

• Disabled MCP servers should not be connected
• Claude should not have access to tools from disabled servers
• claude mcp list should show disabled servers as disconnected or not listed

Actual Behavior

• All 5 servers show as "✓ Connected" when running claude mcp list
• Claude can see and invoke tools from all MCP servers
• The disabledMcpServers setting is completely ignored at runtime

Evidence

Config in ~/.claude.json:

{
  "projects": {
    "/home/rob/Projects/ziggurat": {
      "disabledMcpServers": [
        "leonardo-ai",
        "pixellab",
        "gemini-cli",
        "chrome-devtools",
        "codex-cli"
      ]
    }
  }
}

Output of claude mcp list:

Checking MCP server health...

pixellab: https://api.pixellab.ai/mcp (HTTP) - ✓ Connected
leonardo-ai: https://mcp.leonardo.ai/v1/mcp (HTTP) - ✓ Connected
gemini-cli: npx -y gemini-mcp-tool - ✓ Connected
codex-cli: npx -y codex-mcp-server - ✓ Connected
chrome-devtools: npx chrome-devtools-mcp@latest - ✓ Connected

Related Issues

• #12025 - Feature request to disable MCP servers globally and enable per-project
• #4879 - Feature request for MCP Server Enable/Disable Toggle
• #7068 - Feature request for enable/disable in /mcp command

Impact

Users cannot disable MCP servers per-project. This affects:

• Projects that don't need certain MCP tools (unnecessary tool clutter)
• Security/privacy (servers connect even when not wanted)
• Token usage (disabled tools may still be included in context)