Unclear What each of the three policy answers shows or hides for a user is not settled.
What
MCP servers give Claude extra tools. Plugins can bring their own, and an organization can block claude.ai connectors.
- A plugin MCP server whose address matches a connector the organization blocked can now be blocked. The flag
require_connector_block_on_plugin_serversselects the mode. - Modes include "on", which blocks, and "count_only", which only counts matches. Others are "fault", "unattributed" and "off".
- In "on" mode, sign-in fails with "MCP OAuth refused: connector block" or "MCP OAuth refused: connector check failed".
- Sign-in waits for the connector list and fails with a timeout message if it is slow.
- In "count_only" mode, if recounting fails the message is "The connector block's count after a policy answer failed".
- The connector list can still be turned off with
ENABLE_CLAUDEAI_MCP_SERVERSor thedisableClaudeAiConnectorssetting, now through one check with unchanged behaviour.
Why
Organization admins can stop plugins from reconnecting a blocked service. If a plugin server stops connecting, an organization block may be the reason.
tengu_org_policy_denied Not enough to sayNothing here resolved what this flag was doing on this version, so nothing here should be read as on or off.
This account: no value returned · anonymous baseline: no value returned · compiled default in v2.1.321: not a boolean we can read
These values were read against a different version of Claude Code, so treat them as the nearest reading available instead of one taken on this release.
Read once, for one account on one subscription tier, against v2.1.321. It isn't a statement about your account. What a flag value here can and cannot tell you
What each of the three policy answers shows or hides for a user is not settled.