Claude Code MCP server: `claude mcp serve`, and why the client comes first

How the client handles other people's servers, what one command exposes when the direction reverses, and who is responsible for confirming a tool call then.

Last verified 28 August 2026 · from code.claude.com documentation for MCP, the CLI and the tools

This page is one of 90 in a directory of monitoring and developer tools. Each page checks what an AI coding agent can get out of the tool through its MCP server, the connector that lets the agent query the tool directly.

What is the Claude Code MCP server?

Claude Code is an MCP client that can also run as an MCP server. MCP has two ends. A client holds the conversation and decides which tools to call. A server exposes tools and answers those calls. Almost every vendor in this directory ships a server.

Claude Code is the client end. It reads server configurations, negotiates with them, runs the tools they expose and applies permission rules before anything happens.

One command reverses that. claude mcp serve presents Claude Code's own tools, which read and edit files, run shell commands and search the web, to whatever connects to it over stdin and stdout.

The same product in both roles:

The asymmetry matters. In the first row Claude Code decides what runs. In the second it does not, and the documentation says so.

It is a development tool, so it reaches the code and nothing operational.

For an agent, Claude Code is where the other connectors are used rather than a connector itself. In server mode it hands another model a file system and a shell. That is a larger grant than the vendor servers in this directory make.

What can an AI agent do with Claude Code?

Claude Code documents 45 built-in tools, and 14 need permission inside Claude Code itself, including Bash, Edit, Write, PowerShell, WebFetch and WebSearch. Those are what claude mcp serve registers for a connected client. The documentation is explicit about the consequence. The server exposes only Claude Code's tools to your client, so that client owns confirmation. An agent connected this way reads files, runs shell commands and fetches pages.

What connecting costs before the first question

A context window is the amount of text a model can hold at once. Pointing another client at claude mcp serve loads all 45 of Claude Code's tool definitions. On Claude that costs 4,168 to 5,412 tokens. Fourteen of them require permission inside Claude Code itself.

This is the one page in the guide where the connector runs in the other direction, so the cost lands on whichever client you attach rather than on Claude Code. Shell execution and file writes are in that list.

Encodings: GPT-5.6, GPT-5.5 o200k_base; GPT-4, GPT-3.5 cl100k_base; Claude Haiku 4.5 to Opus 5 count_tokens. Counted from the 45 tool entries in the vendor's own documentation. That documentation is the only public inventory.

The server could not be run for a live tools/list. No input schemas are available, so these figures cover each tool's name and description only. They are a floor, not the figure.

The Claude columns are measured through the API's count_tokens endpoint with an empty schema per tool. So they cover the same content as the GPT columns. The range there is two tokenizer generations. Haiku 4.5 and Opus 4.6 are at the low end. Opus 5 and Sonnet 5 are at the high end. The gap between them is about a third.

Can Claude Code watch your own AI agents?

Mostly no. Claude Code is the agent in these setups rather than the thing watching one, so the signals below describe its own session and not a model you are running. Read from the Claude Code documentation on 25 August 2026.

Claude Code MCP server limits: where answers come back incomplete

Claude Code changes the approval boundary: its first limitation decides who is responsible for a tool call.

How to configure Claude Code MCP for agents

1. 1

   Decide which direction you actually need

   Adding a vendor server is the common case. Running claude mcp serve is the rare one, and it is the one that exposes more if it goes wrong.

2. 2

   Give the full executable path in server mode

   The documentation warns that a command not on the system PATH produces spawn claude ENOENT, and points at which claude.

3. 3

   Budget tool output

   A warning appears past 10,000 tokens and the default ceiling is 25,000, changed with MAX_MCP_OUTPUT_TOKENS.

4. 4

   Know the startup wait

   With -p, Claude Code waits for pending servers up to MCP_TIMEOUT, 30 seconds by default. A server with a cached tool list skips the wait.

5. 5

   Use --strict-mcp-config for a reproducible run

   It ignores every other MCP configuration and uses only what --mcp-config names.

Paste this into your agent’s instructions

In server mode the confirmation step moves to the other side. An agent describing its own actions is the only remaining record of what it did.

When you answer using Claude Code as an MCP server, state:
- Which tool ran and which paths or commands it touched.
- That confirmation is the connecting client's job here.
  Claude Code's own permission prompts do not apply.
- Whether a command changed files or only read them.
Never state that data does not exist. State the path you
read and what the tool returned.
Write your answer in ASD-STE100 Simplified Technical
English. Use short sentences with one idea in each.

Do you need the MCP server at all?

Usually no, not in server mode. For most tasks the question is which vendor server to add to Claude Code, and every other guide in this directory answers that.

Where another application needs file and shell access, its own tooling is usually the smaller grant. Server mode hands over Claude Code's whole tool list at once.

For a scripted run, --strict-mcp-config with an explicit --mcp-config file is the reproducible shape, and it makes the server set reviewable.

Where output size is the problem, a server that supports narrowing the query is better than a higher ceiling. Elastic and Prometheus both do this cheaply.

Add servers to it freely. Run it as a server only where the other side prompts.

Claude Code MCP server setup

Nothing is installed for either direction. Both are the claude CLI already on your machine.

No credential appears in the server-mode block below. It launches a local process over stdio, so there is no endpoint to authenticate against and no token to store.

The client-mode commands are the ones every other page in this directory uses. They are collected here for reference.

claude mcp serve

{"mcpServers":{"claude-code":{"type":"stdio",
  "command":"claude",
  "args":["mcp","serve"],
  "env":{}}}}

{"mcpServers":{"claude-code":{"command":"claude",
  "args":["mcp","serve"]}}}

claude mcp add --transport http <name> <url>
claude mcp add-json "<name>" '{"command":"npx", ...}'
claude mcp list
claude mcp get <name>

claude mcp login <name>
claude mcp login <name> --no-browser
claude mcp logout <name>

Every other client

Each block below is the configuration for one client, with the file path and the key that client expects.

MAX_MCP_OUTPUT_TOKENS=50000 claude

claude --strict-mcp-config --mcp-config ./mcp.json

MCP_TIMEOUT=10000 claude -p "..." --mcp-config ./mcp.json

claude --bare -p "query"
claude --safe-mode

Read-only access, permissions and security

• In server mode, confirmation is not Claude Code's job

  The documentation states that the server only exposes Claude Code's tools to your client, and that the client is responsible for implementing user confirmation for individual tool calls.

• The tools on offer are broad

  Claude Code documents 45 built-in tools, of which 14 require permission inside Claude Code itself, including Bash, Edit, Write, PowerShell, WebFetch and WebSearch.

• A stdio server has no network boundary

  It is a local process reading stdin, so the protection is whatever the connecting application enforces, plus the file permissions of the account that launched it.

• As a client, an untrusted server's output is still text a model reads

  The output ceiling limits how much of it arrives, not whether it is trustworthy.

• --strict-mcp-config is the audit lever

  It guarantees a run used only the servers named on the command line, which is otherwise hard to prove on a developer machine.

Troubleshooting

`claude mcp serve` prints nothing

That is documented behavior, not a failure. A stdio server communicates over stdin and stdout, so a silent, blocked terminal means it is running and waiting for a client.

`spawn claude ENOENT`

The command field must reference the Claude Code executable. Run which claude and put the full path in the configuration.

A tool result is truncated or warned about

Claude Code warns past 10,000 tokens of MCP output and stops at the maximum, 25,000 by default. Raise it with MAX_MCP_OUTPUT_TOKENS.

A scripted run stalls at startup

With -p, Claude Code waits for pending servers up to MCP_TIMEOUT, 30 seconds by default. A server with a cached tool list is not waited for.

A server will not authenticate over SSH

Use claude mcp login <name> --no-browser. It prints the authorization URL to paste, then takes the redirect URL back at the prompt. Requires version 2.1.186 or later.

You cannot tell which server broke the session

Start with --safe-mode, which loads no customisations at all, or --bare, which skips MCP discovery while keeping shell and file tools.

Claude Code MCP server: Reference

What the vendor documents

The useful record here is the documentation itself, which states the limits numerically rather than describing them.

“This MCP server only exposes Claude Code's tools to your MCP client, so your own client is responsible for implementing user confirmation for individual tool calls.”

“The command prints nothing when it starts. A stdio MCP server communicates over stdin and stdout, so a silent, blocked terminal means the server is running and waiting for a client to connect.”

“Without the correct executable path, you'll encounter errors like spawn claude ENOENT.”

Facts on this page come from three Anthropic documentation pages read on 25 August 2026: the MCP guide, the CLI reference and the tools reference. The built-in tool count is the number of rows in the tools table, and the permission count is the rows marked as requiring permission.

Should you connect an agent to Claude Code?

Yes. Best for client mode always. Server mode only where the connecting application prompts for each call.

Strongest fit

Everyone connecting a vendor server, which is the usual direction and the reason most of this directory exists.

Main advantage

The client side is explicit about cost and reproducibility: an output ceiling, a startup timeout and a flag that ignores every configuration except the one named.

Main weakness

Server mode moves the confirmation step to the other application, and the documentation is clear that it does.

Operational risk

A client without per-call prompts driving 45 built-in tools, including shell execution and file writes.

Frequently asked questions