{"version":"2.1.317","anchor":"mcp-legacy-key-grants-enforcement-flag","canonical_anchor":"mcp-legacy-key-grants-enforcement-flag","heading":"MCP legacy-key ownership checks can enforce grants behind a server switch","tier":"soon","area":"MCP","scope":"individual","heads_up":false,"url":"https:\/\/changelogs.core-directive.com\/v\/2.1.317\/e\/mcp-legacy-key-grants-enforcement-flag","release_url":"https:\/\/changelogs.core-directive.com\/v\/2.1.317","markdown":"### MCP legacy-key ownership checks can enforce grants behind a server switch\n\nThe check deciding which MCP servers may record an owner with a legacy key was reworked around a new enforcesGrants value\n\n**What**\n\nMCP servers are outside programs that give Claude extra tools. Claude Code has a check that decides whether an MCP server may record an owner using an older, legacy kind of key. That check was reworked:\n\n- The legacy-key owner setup now receives an `enforcesGrants` value. It is read from a server-controlled switch with a fallback of false, so it is treated as off unless the server turns it on. Before, the setup received only read and claim.\n\n- The ownership check now tracks `claimedMayNotOwn`, and it requires `enforcesGrants`, or a fallback check, before it records a refusal. Before, it used `refusedLegacyKeys` and a single check.\n\n- The helper that decides whether to deny now looks at the server's identity, not only its name.\n\n**Why**\n\nThis changes which MCP servers are refused when they use legacy ownership keys. The stricter handling depends on a switch the server controls, so it may not apply to every account.\n\n- Area: MCP\n- Tier: Nothing to try yet\n- Useful: 1\/5\n- Signal: 3\/5\n- Scope: individual\n- Heads-up: no\n- Present in the build but not switched on"}