What
A managed setting can now refuse MCP servers pushed in from outside your own config. When disableSideloadFlags is set, the CLI warns that --mcp-config is forbidden on the machine and drops server-delivered MCP servers with a stated reason instead of loading them.
Details
- The reason string is "disableSideloadFlags policy", alongside the existing safe-mode and hermetic-mode refusal reasons.
- Dropped servers are reported as "Ignored: managed setting disableSideloadFlags forbids server-delivered MCP servers on this machine".
- Off unless an administrator sets the policy in managed settings.
Evidence
disableSideloadFlags policy
Strings lifted out of the shipped bundle, so the claim above can be checked against them.
Names in the bundledisableSideloadFlags--mcp-config
The entry above is what we published on the day. These lines were added later, as Anthropic's own pages caught up, and they sit beside the original rather than replacing it.
Added since
A small documentation edit on All settings touched a line naming --mcp-config after this was published.
In cloud sessions, Claude Code also ignores server-delivered mid-session MCP updates, the path behind cloud session configuration and SDK `setMcpServers()` calls that reach those sessions. In-process `type: "sdk"` entries stay exempt there…settings-reference see the edit
Confirmed since
Anthropic's documentation has since written up --mcp-config, on CLI reference.
| `claude agents` | Open [agent view](/docs/en/agent-view) to monitor and dispatch parallel background sessions. Use `--cwd <path>` to show only sessions started under that directory, or `--json` to print active sessions as a JSON array fo…cli-reference see the edit
One source agreesOne thing we can check says the same as this entry.
Anthropic's documentation agrees
Anthropic's documentation has since written up --mcp-config, on CLI reference.