Unclear Which setting turns this on, and whether it is on by default, is not clear.
What
MCP servers are outside programs that give Claude extra tools. Claude Code now attaches a provenance label, ownership_metadata, to these tools and to their results before sending them to Anthropic's API.
- Each MCP server is classed as
configured(set up by you) orconnector. - The label reads
{verified:false, owner:'mcp', server_url?}: the content is unverified, owned by an MCP server, and may include the server's address. - Connector addresses are hidden unless known to be safe.
- If the API refuses a
server_url, Claude Code logs "[tool-provenance] the API refused a server_url; marking tools without addresses and retrying" and sends again without addresses. - The feature uses a beta flag and an
api_tool_provenancemarker. In cloud sessions it also records the MCP addresses present at launch, usingCLAUDE_CODE_REMOTEandCLAUDE_CODE_ENVIRONMENT_KIND. - The tool sanitizer strips
ownership_metadatafrom tool definitions in another path that sends tools to the API. - Separately, WebFetch's output gains an optional internal
citablefield, and several new internal diagnostic names were added.
Why
The model can now tell that output from an MCP tool is unverified, third-party content rather than something Claude Code itself produced. This changes what each request carries.
Something disagreesSomething we can check disagrees with this entry, or the writer said they could not settle it.
The writer flagged doubt
Which setting turns this on, and whether it is on by default, is not clear.