{"version":"2.1.319","anchor":"managed-policy-blocks-on-mcp-get-an-mcp-policy-blocked-error","canonical_anchor":"managed-policy-blocks-on-mcp-get-an-mcp-policy-blocked-error","heading":"MCP servers blocked by managed policy now return the error code mcp_policy_blocked","tier":"notice","area":"SDK","scope":"both","heads_up":false,"url":"https:\/\/changelogs.core-directive.com\/v\/2.1.319\/e\/managed-policy-blocks-on-mcp-get-an-mcp-policy-blocked-error","release_url":"https:\/\/changelogs.core-directive.com\/v\/2.1.319","markdown":"### MCP servers blocked by managed policy now return the error code mcp_policy_blocked\n\nWhen organisation policy blocks an MCP server, programs driving Claude Code now get the error code mcp_policy_blocked before any connection is attempted\n\n**What**\n\nMCP servers are add-ons that give Claude Code extra tools. When a program drives Claude Code through the SDK and asks for something that needs an MCP server blocked by managed policy (settings an organisation deploys), Claude Code now refuses with the error code `mcp_policy_blocked` before it tries to connect. This covers:\n\n- `mcp_toggle`\n\n- `mcp_reconnect`\n\n- `mcp_authenticate`\n\n- `mcp_read_resource`\n\n`mcp_read_resource` now also records why it failed, either a reserved address or a policy block, before it reports the error. Before, the only MCP error codes listed were `mcp_client_registration_unavailable` and `mcp_redirect_uri_unusable`.\n\nThe SDK documentation also now notes that deny and ask rules and hook matchers written as `mcp__<connectorId>` reach that server's tools as well.\n\n**Why**\n\nA program can now tell a policy block apart from other MCP failures and show the right message, rather than treating it as a connection problem.\n\n- Area: SDK\n- Tier: You'll notice\n- Useful: 2\/5\n- Signal: 1\/5\n- Scope: both\n- Heads-up: no"}