A subagent is a helper agent that Claude Code starts for a task, and its definition can list MCP servers (add-ons that give extra tools). Those servers are now skipped if they have not been approved for the current project. Claude Code reports them as "missing project approval (approve via /mcp)". Before, only servers blocked by a managed policy were kept out.
An agent defined in a project you have not approved can no longer quietly connect its own MCP servers. To use them, approve them with /mcp.
The entry above is what we published on the day. These lines were added later, as Anthropic's own pages caught up, and they sit beside the original rather than replacing it.
The **Needs certificate** badge next to the tunnel's name goes away once a certificate is registered. See [Add a CA certificate](https://platform.claude.com/docs/en/agents-and-tools/mcp-tunnels/console#add-a-ca-certificate).agents-and-tools/mcp-tunnels/deploy-compose see the edit
* For other reserved names to avoid, see [MCP configuration warnings](/docs/en/mcp#configuration-warnings)errors see the edit
Anthropic's documentation has since written up /mcp, on Error reference.