What
Several related pieces changed in how Claude Code handles messages and tool servers in sessions that run on remote machines, called workers:
- Messages that come from a plugin now keep a flag saying whether they should be treated as coming from the user.
- Consent checks for artifacts now take a flag limiting them to the user.
- A host chat key in the form
chat:<uuid>is now checked and reported as unset, malformed, ignored or used. - An MCP server (an outside program that gives Claude extra tools) can be refused with the message "Not admitted: this name is reserved for a first-party server, and this entry cannot be added after session start".
- An MCP server can be removed with the message "Removed: its per-tool limits are more than this worker can keep; it returns when the session next moves to another worker".
Why
If a tool server disappears or is refused during a remote session, these messages explain why: its name clashes with one of Anthropic's own servers, or it asks for more per-tool limits than the current worker supports.
Something disagreesSomething we can check disagrees with this entry, or the writer said they could not settle it.
The writer flagged doubt
It is not clear what switches these paths on or what the user-only flags change in practice.