rdmsm4x-changelog-20260918-1210-deny-enterprise-search-mcp-servers-fleet-wide

Five unused MCP servers (asana, atlassian, guru, notion, slack) denied at user level on all six Macs, 2026-09-18 12:10:39 EDT. They were never in Rich's own MCP config: the Claude desktop app injects them through its bundled enterprise-search plugin (~/Library/Application Support/Claude/local-agent-mode-sessions/*/cowork_plugins/marketplaces/knowledge-work-plugins/enterprise-search/.mcp.json), which is hash-managed and would be rewritten on update — so the plugin file was left alone.

Change

• ~/.claude/settings.json on rdmsm4x, rdmbair13m5, rdmbair15m5, jdmbair13m5, rdmpw3265m, rdmpw3275m: new key deniedMcpServers, 10 entries — per server one serverName (plugin:enterprise-search:<name>) and one serverUrl wildcard (mcp.asana.com, mcp.atlassian.com, mcp.api.getguru.com, mcp.notion.com, mcp.slack.com).
• Read-modify-write immediately before writing; asserted permissions.defaultMode unchanged (bypassPermissions on all six) and key count +1. On rdmsm4x the rest of the file diffed identical to the backup.
• The plugin's skills and its ms365 server are untouched.

Verification — incomplete, stated plainly

• claude mcp list shows none of the five, but it lists zero plugin servers at all, so that check cannot fail and proves nothing. The real test is the startup banner of the next desktop-app session: the "require authentication" list should no longer name these five.

Undo

• Each host: ~/.claude/settings.json.bak-<timestamp>-pre-deny-mcp, or delete the deniedMcpServers key.