claude-threads 1.34.2 → 1.35.0

package/docs/CONFIGURATION.md

@@ -24,6 +24,12 @@ platforms:
     allowedUsers: [alice, bob]
     permissionMode: default
     memory: true                  # persistent memory (default on; see Memory below)
+    claudeAiConnectors: false     # keep the account's Gmail/Drive/Calendar out of sessions (default; see MCP servers below)
+    mcpServers:                   # extra MCP servers for this platform's sessions
+      github:
+        command: npx
+        args: [-y, "@modelcontextprotocol/server-github"]
+        env: { GITHUB_TOKEN: ghp-your-token }
 
   # Slack
   - id: slack-eng
@@ -52,6 +58,7 @@ platforms:
 | `threadLogs` | Thread logging (see below) | enabled |
 | `stickyMessage` | Sticky message text customization (see below) | none |
 | `claudeAccounts` | Multi-account pool (see below) | single-account mode |
+| `mcpServers` | MCP servers every platform's sessions get, on top of the bot's own (see [MCP servers and claude.ai connectors](#mcp-servers-and-claudeai-connectors-claudeaiconnectors-mcpservers-strictmcpconfig)) | none |
 
 ### Resource Limits (`limits`)
 
@@ -298,6 +305,51 @@ The `permissionMode` field controls how the bot handles a session's tool-use req
 
 A running session can switch mode at any time with `!permissions <mode>`; that override is not persisted across a bot restart.
 
+### MCP servers and claude.ai connectors (`claudeAiConnectors`, `mcpServers`, `strictMcpConfig`)
+
+Sessions run with the MCP servers the machine already has, as the README promises: the user-level servers of the account the bot runs under, servers bundled with installed plugins, and any `.mcp.json` in the working directory, plus the bot's own permission server. One thing is excluded by default: the account's **claude.ai connectors** (Gmail, Google Drive, Google Calendar, ...). A bot run under a personal account used to hand every session in the channel that person's mailbox; anyone on `allowedUsers` could ask for it, and a message let through by the approval flow or a watch firing on channel content could reach it without anyone meaning to. The bot now passes `disableClaudeAiConnectors` in the CLI's inline settings, which drops exactly those and nothing else.
+
+| Setting (per platform) | Default | Effect |
+|---|---|---|
+| `claudeAiConnectors` | `false` | `true` lets the account's claude.ai connectors into this platform's sessions. Only for a platform whose users may act as that account. Done two ways: the `disableClaudeAiConnectors` setting (present from 2.1.251, verified there and on 2.1.263) and the `ENABLE_CLAUDEAI_MCP_SERVERS=false` env var on every child, which also covers older CLIs (verified on 2.1.112). Should connectors show up anyway, the session posts a warning in the thread. |
+| `mcpServers` | none | Extra servers for this platform's sessions, merged over the top-level `mcpServers` (the platform wins on a name clash). See below. |
+| `strictMcpConfig` | `false` | `true` passes `--strict-mcp-config`: the session gets only the bot's own blob (its permission server plus `mcpServers`) and nothing from the account, plugins or the repo. Opt-in hardening for a channel that should see exactly the declared set. |
+
+Declaring servers, at the top level for every platform or per platform:
+
+```yaml
+mcpServers:                       # top level: every platform
+  docs:
+    type: http                    # or sse
+    url: https://mcp.example.com/
+    headers: { Authorization: "Bearer ..." }
+
+platforms:
+  - id: mattermost-main
+    # ... credentials ...
+    mcpServers:                   # this platform only
+      github:
+        command: npx              # stdio server: command, optional args and env
+        args: [-y, "@modelcontextprotocol/server-github"]
+        env: { GITHUB_TOKEN: ghp-your-token }
+```
+
+A stdio server needs `command` (with optional `args` and `env`); a remote one needs `type: http` or `type: sse` and a `url` (with optional `headers`). Keys outside those are rejected, as is an entry with both `command` and `url`. The name `claude-threads-mcp` is reserved for the bot's own server. A malformed entry stops the bot at startup with the field path in the message, rather than dropping the server silently. Secrets in `env` and `headers` travel in the same owner-only tempfile as the bot's platform token, never on the command line.
+
+Three things to know about stdio servers:
+
+- The CLI expands `${VAR}` in `args` and `env` from its own environment (verified on 2.1.263), so `env: { GITHUB_TOKEN: "${GITHUB_TOKEN}" }` keeps the token out of `config.yaml`. With a Claude account pool that environment is the pooled account's (`HOME` is overridden per session).
+- A declared server inherits the CLI's environment, including `ANTHROPIC_API_KEY` when the session runs on an API-key pool account. `CLAUDE_CODE_SUBPROCESS_ENV_SCRUB=1` (see Environment Variables) makes the CLI strip those credentials from the servers it spawns.
+- On Windows, `npx` and other `.cmd` shims need `command: cmd` with `args: ["/c", "npx", ...]`.
+
+`strictMcpConfig: true` has one more consequence: on a machine with an enterprise-managed MCP config (`managed-mcp.json` under `/Library/Application Support/ClaudeCode`, `/etc/claude-code` or `C:\Program Files\ClaudeCode`) the CLI refuses the flag and exits. The bot checks for that file at startup and runs the platform without the flag, with a warning, because the organization's policy already decides which servers load there. The check is best-effort (the CLI also takes managed MCP from managed settings and, on Windows, the registry); when it misses, the first session's early-exit message names the refusal and the `strictMcpConfig: false` way out.
+
+The same exclusion applies to the bot's own haiku one-shots (watch confirms, distillation, routine and watch parsing, title suggestions): they run with the connectors disabled as well.
+
+If you relied on the connectors before 1.35.0, the bot tells you. At startup it runs one free `claude -p "/usage"` per account and reads the connectors from the CLI's init event; when an account has some and no platform allows them, the startup log names them with the `claudeAiConnectors: true` fix, and the channel sticky shows a `🔌 3 claude.ai connectors off` chip until you decide. With a platform opted in, the log lists which platforms have them instead.
+
+Each session logs the servers the CLI reported at start (`MCP servers: claude-threads-mcp (connected), github (failed)`) and warns when one did not connect. That line is the place to look when a declared server's tools do not show up, and it is where an old CLI's ignored `disableClaudeAiConnectors` becomes visible.
+
 ### Quieting the bot's overhead messages
 
 Both the per-thread session header and the channel sticky message default to `full` for backward compatibility. To strip them down on a noisy channel, set the per-platform fields in `config.yaml`:

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "claude-threads",
-  "version": "1.34.2",
+  "version": "1.35.0",
   "description": "Run Claude Code from Slack or Mattermost. Sessions stream live into threads where your whole team can watch and steer.",
   "main": "dist/index.js",
   "type": "module",