What
If an agent's frontmatter declares MCP servers inline rather than by name, and the folder the agent is defined in is not trusted, those servers are now dropped for both the main thread and subagents. A log names the source and tells you to accept the trust dialog or set hasTrustDialogAccepted. There is no flag: this applies to anyone whose agent files live outside a trusted project.
Details
- Only inline (non-string) server definitions are affected; agents that reference servers by name are unchanged.
- The existing untrusted-origin telemetry event gained a
whatfield distinguishing"hooks"from"mcpServers". - The warning is deduplicated per agent and surface, so it is logged only the first time.
Evidence
tengu_agent_hooks_origin_untrusted
Strings lifted out of the shipped bundle, so the claim above can be checked against them.
Names in the bundlehasTrustDialogAccepted
The entry above is what we published on the day. These lines were added later, as Anthropic's own pages caught up, and they sit beside the original rather than replacing it.
Confirmed since
Anthropic's documentation has since written up hasTrustDialogAccepted, on Error reference.
* Or set the `hasTrustDialogAccepted` entry to `true` in `~/.claude.json`, using the exact `projects["<path>"]` key the debug log printserrors see the edit
One source agreesOne thing we can check says the same as this entry.
Anthropic's documentation agrees
Anthropic's documentation has since written up hasTrustDialogAccepted, on Error reference.