Under CLAUDE_CODE_REMOTE, built-in Slack/Teams bot MCP servers are marked CCR-injected and skip the usual allowlist and type restrictions
What
When Claude Code is running under CLAUDE_CODE_REMOTE (its remote/bridge mode), MCP server configs that match known built-in Claude-Code-Remote (CCR) endpoints for Slack and Teams bots (slackbot, slackbot_read, ccr-slack-thread, teamsbot) are now marked as CCR-injected.
- These CCR-injected configs bypass the user's
allowedMcpServersallowlist check entirely, instead of being blocked like other unlisted servers. - The server reconciliation logic that normally only lets
type === 'sdk'MCP servers through in restricted or remote scenarios now also admits these non-sdk, CCR-injected servers (tracked in accrInjectedConfigsset), as long as Claude Code is not running as a bridge-carrier child process.
Why
This lets the built-in Slack and Teams bot integrations keep working over MCP in remote mode without requiring users to manually add them to their MCP server allowlist.
The entry above is what we published on the day. These lines were added later, as Anthropic's own pages caught up, and they sit beside the original rather than replacing it.
* [Server-managed settings](/docs/en/server-managed-settings): deliver `allowedMcpServers` and `deniedMcpServers` from the claude.ai admin consolemanaged-mcp see the edit
* **No cloud-only scoping**: hooks run in both local and cloud sessions. To skip local execution, exit early unless the `CLAUDE_CODE_REMOTE` environment variable is `true`, the way the [dependency install script](#install-dependencies-with…cloud-environments see the edit
| Restriction allowlists | Takes the list whole from the highest source that sets it, without adding entries from lower sources. When the highest source doesn't set one, takes it whole from the next source down | [`availableModels`](#avail…settings-reference see the edit
Anthropic's documentation has since written up allowedMcpServers, on All settings.