claude-code - 💡(How to fix) Fix enableAllProjectMcpServers should default to false for security [2 comments, 2 participants]

TL;DR

Default enableAllProjectMcpServers to false to prevent automatic loading of MCP servers from cloned repositories.

Guidance

• Set enableAllProjectMcpServers to false in the Claude Code configuration to mitigate the security concern.
• Require explicit opt-in per project or implement a one-time confirmation prompt when project-level MCP servers are detected.
• Verify the fix by cloning a repository with a .mcp.json file and checking that the MCP servers are not automatically loaded into the Claude Code session.
• Consider updating the default configuration in future versions of Claude Code to reflect this security best practice.

Example

No code snippet is provided as the issue does not require a specific code change, but rather a configuration update.

Notes

This fix assumes that the enableAllProjectMcpServers configuration option is available and functional in Claude Code version 2.1.84. If this option is not available, alternative mitigation strategies may be necessary.

Recommendation

Apply the workaround by setting enableAllProjectMcpServers to false, as this is a straightforward and effective way to address the security concern. This change is recommended based on the security research and guidelines provided by Check Point and Trail of Bits.