Follow-up to #47. A counter-measure now exists but it is host-local, so it protects one machine out of three.
What happened
The per-turn MCP auth reminder names connected servers as needing authentication. On 2026-09-15 claude mcp list showed 11 of 11 ✔ Connected while the reminder listed 7 as unauthenticated. Acting on it, an agent twice told the user a working capability was unavailable.
A brain entry and an agent-memory entry already existed saying exactly what the reminder means. Both lost, and the reason is structural rather than a discipline failure:
Proximity — the reminder fires per turn, adjacent to the reasoning; memory is background context loaded once at session start.
Form — the reminder is imperative ("Tell the user that these servers need to be authorized"); a memory is a passive fact.
A fact competes, an action resolves — "it's actually the connector" is a claim to weigh against a contradicting claim. "Call it once before asserting" is not.
The fix, and why it is only half a fix
A UserPromptSubmit hook in ~/.claude/settings.json now injects the counter-line into the same per-turn channel:
MCP AUTH REMINDERS ON THIS HOST ARE UNRELIABLE: on 2026-09-15 all 11 servers were
connected while the reminder named 7 as needing auth. Never tell the user an MCP
capability is unavailable without first calling the tool once (a real failure is
instant and unambiguous) or running: claude mcp list.
Plugin servers are mcp__plugin_skills_{brain,gitea,infra}__*.
Verified firing. ~90 tokens per turn.
Two residual gaps:
It is in personal settings on koala only. flamingo and iguana have the same duplicate-name topology and no counter-measure. This plugin already ships secret-guard and pre-task-ritual hooks, which is the mechanism that would propagate it.
It is a stronger prompt, not a gate. The failure mode is an assertion in prose, and there is no tool call to intercept — a PreToolUse hook has nothing to match on. This is the strongest mechanism the harness offers for this class, and it is worth being explicit that it is mitigation rather than enforcement.
Proposed
Ship the hook from this plugin so every host gets it, rather than leaving it as a per-machine edit that the next install.sh does not know about.
Keep the text carrying both the evidence and the action — the evidence is what lets it survive contact with a confidently-worded reminder. A bare "verify first" would lose the same argument the memory lost.
Related
#47 — renaming the plugin servers, considered and declined with the blast radius measured
Follow-up to #47. A counter-measure now exists but it is host-local, so it protects one machine out of three.
## What happened
The per-turn MCP auth reminder names connected servers as needing authentication. On 2026-09-15 `claude mcp list` showed **11 of 11 ✔ Connected** while the reminder listed 7 as unauthenticated. Acting on it, an agent twice told the user a working capability was unavailable.
A brain entry and an agent-memory entry already existed saying exactly what the reminder means. **Both lost**, and the reason is structural rather than a discipline failure:
- **Proximity** — the reminder fires per turn, adjacent to the reasoning; memory is background context loaded once at session start.
- **Form** — the reminder is imperative ("Tell the user that these servers need to be authorized"); a memory is a passive fact.
- **A fact competes, an action resolves** — "it's actually the connector" is a claim to weigh against a contradicting claim. "Call it once before asserting" is not.
## The fix, and why it is only half a fix
A `UserPromptSubmit` hook in `~/.claude/settings.json` now injects the counter-line into the same per-turn channel:
```
MCP AUTH REMINDERS ON THIS HOST ARE UNRELIABLE: on 2026-09-15 all 11 servers were
connected while the reminder named 7 as needing auth. Never tell the user an MCP
capability is unavailable without first calling the tool once (a real failure is
instant and unambiguous) or running: claude mcp list.
Plugin servers are mcp__plugin_skills_{brain,gitea,infra}__*.
```
Verified firing. ~90 tokens per turn.
**Two residual gaps:**
1. **It is in personal settings on koala only.** flamingo and iguana have the same duplicate-name topology and no counter-measure. This plugin already ships `secret-guard` and `pre-task-ritual` hooks, which is the mechanism that would propagate it.
2. **It is a stronger prompt, not a gate.** The failure mode is *an assertion in prose*, and there is no tool call to intercept — a `PreToolUse` hook has nothing to match on. This is the strongest mechanism the harness offers for this class, and it is worth being explicit that it is mitigation rather than enforcement.
## Proposed
Ship the hook from this plugin so every host gets it, rather than leaving it as a per-machine edit that the next `install.sh` does not know about.
Keep the text carrying **both the evidence and the action** — the evidence is what lets it survive contact with a confidently-worded reminder. A bare "verify first" would lose the same argument the memory lost.
## Related
- #47 — renaming the plugin servers, considered and declined with the blast radius measured
- brain: `wiki/homelab/failures/claude-code-mcp-auth-reminder-is-not-evidence`
---
_Created via git-mcp on behalf of @mathias_
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
Follow-up to #47. A counter-measure now exists but it is host-local, so it protects one machine out of three.
What happened
The per-turn MCP auth reminder names connected servers as needing authentication. On 2026-09-15
claude mcp listshowed 11 of 11 ✔ Connected while the reminder listed 7 as unauthenticated. Acting on it, an agent twice told the user a working capability was unavailable.A brain entry and an agent-memory entry already existed saying exactly what the reminder means. Both lost, and the reason is structural rather than a discipline failure:
The fix, and why it is only half a fix
A
UserPromptSubmithook in~/.claude/settings.jsonnow injects the counter-line into the same per-turn channel:Verified firing. ~90 tokens per turn.
Two residual gaps:
It is in personal settings on koala only. flamingo and iguana have the same duplicate-name topology and no counter-measure. This plugin already ships
secret-guardandpre-task-ritualhooks, which is the mechanism that would propagate it.It is a stronger prompt, not a gate. The failure mode is an assertion in prose, and there is no tool call to intercept — a
PreToolUsehook has nothing to match on. This is the strongest mechanism the harness offers for this class, and it is worth being explicit that it is mitigation rather than enforcement.Proposed
Ship the hook from this plugin so every host gets it, rather than leaving it as a per-machine edit that the next
install.shdoes not know about.Keep the text carrying both the evidence and the action — the evidence is what lets it survive contact with a confidently-worded reminder. A bare "verify first" would lose the same argument the memory lost.
Related
wiki/homelab/failures/claude-code-mcp-auth-reminder-is-not-evidenceCreated via git-mcp on behalf of @mathias