{"version":"2.1.318","anchor":"tool-provenance-ownership-metadata-attached-to-api-tools-a","canonical_anchor":"tool-provenance-ownership-metadata-attached-to-api-tools-a","heading":"MCP tools and their results are now labelled with where they came from","tier":"internal","area":"MCP","scope":"individual","heads_up":false,"url":"https:\/\/changelogs.core-directive.com\/v\/2.1.318\/e\/tool-provenance-ownership-metadata-attached-to-api-tools-a","release_url":"https:\/\/changelogs.core-directive.com\/v\/2.1.318","markdown":"### MCP tools and their results are now labelled with where they came from\n\nTools from MCP servers and their output are now marked as unverified, MCP-owned content when sent to the model, with the server address where safe\n\n**Unclear.** Which setting turns this on, and whether it is on by default, is not clear.\n\n**What**\n\nMCP servers are outside programs that give Claude extra tools. Claude Code now attaches a provenance label, `ownership_metadata`, to these tools and to their results before sending them to Anthropic's API.\n\n- Each MCP server is classed as `configured` (set up by you) or `connector`.\n\n- The label reads `{verified:false, owner:'mcp', server_url?}`: the content is unverified, owned by an MCP server, and may include the server's address.\n\n- Connector addresses are hidden unless known to be safe.\n\n- If the API refuses a `server_url`, Claude Code logs \"[tool-provenance] the API refused a server_url; marking tools without addresses and retrying\" and sends again without addresses.\n\n- The feature uses a beta flag and an `api_tool_provenance` marker. In cloud sessions it also records the MCP addresses present at launch, using `CLAUDE_CODE_REMOTE` and `CLAUDE_CODE_ENVIRONMENT_KIND`.\n\n- The tool sanitizer strips `ownership_metadata` from tool definitions in another path that sends tools to the API.\n\n- Separately, WebFetch's output gains an optional internal `citable` field, and several new internal diagnostic names were added.\n\n**Why**\n\nThe model can now tell that output from an MCP tool is unverified, third-party content rather than something Claude Code itself produced. This changes what each request carries.\n\n- Area: MCP\n- Tier: Under the hood\n- Useful: 2\/5\n- Signal: 3\/5\n- Scope: individual\n- Heads-up: no"}