Why did two MCP connectors appear in a session without anyone installing or approving them?
A server-pushed feature flag silently enabled Gmail and Google Calendar MCP connectors in a user's config with no consent, prompting a full security investigation before the cause was found.
Category: AI / Agents · Trend: Agents · Opportunity score: 7.0 / 10
What is the “Why did two MCP connectors appear in a session without anyone installing or approving them?” problem in 2026?
A server-pushed feature flag silently enabled Gmail and Google Calendar MCP connectors in a user's config with no consent, prompting a full security investigation before the cause was found.
Who has this problem?
Security-conscious developers running Claude Code in environments with OAuth-connected services.
Recorded source context
Dataset source note: These integrations were silently enabled via a server-pushed GrowthBook feature flag (tengu_claudeai_mcp_connectors: true) in ~/.claude.json... if OAuth tokens had been previously configured, these would have silently connected without notification.
This note may summarize the referenced material rather than quote it verbatim. Source label: anthropics/claude-code GitHub issue #28941, manfromdownunder, 26 Feb 2026. (reference).
Existing players in this space
- Manual config auditing: Users have to notice and diff ~/.claude.json themselves to catch it.
- Revoke Google OAuth: Blunt fix, breaks any legitimate use of the integration too.
What existing players are missing
A local config-change watcher that flags any server-pushed feature flag or connector addition the moment it appears, before OAuth can silently complete.
How Real Problem AI scores this opportunity
Aggregate score: 7.0 / 10. Four-axis rubric:
- Problem severity: 8 / 10
- AI feasibility today: 7 / 10
- Market signal: 5 / 10
- Competition gap: 8 / 10
How to build a solution: stack hints
- Config file diff watcher
- Feature-flag change alerting
- OAuth pre-connection consent gate
- Local audit log
Related AI / Agents problems on Real Problem AI
- My AI agent repeated one broken action all night, and I only saw the cost in the morning. (9.0/10)
- Someone opened a function to fix one bug and it was 300 lines nobody wrote by hand. (9.0/10)
- Why can a hidden line of text on a webpage hijack my AI agent and steal my data? (8.0/10)
- Why does my AI agent have the same production access as my senior engineer but none of the judgment? (8.0/10)
- Why does Claude Code hide your own plan quota from the terminal you live in? (8.0/10)