Anthropic’s Claude Code is tightening the integration between its client-side agent and external Model Context Protocol (MCP) servers. The latest installment in a technical deep-dive series reveals that the client does not simply dump server-declared tools into a shared list. Instead, it constructs a strict, namespaced callable identity for every external tool, ensuring that a create_issue function from Jira never conflicts with one from Linear. This architectural choice prioritizes collision safety and provenance, treating the namespace as both a routing mechanism and a security boundary.

The Namespace as a Security and Routing Layer

The core mechanism involves prefixing every external tool with mcp____. For plugin-provided servers, the schema expands to mcp__plugin____. This is not merely cosmetic; it provides the model with immediate context about the tool's origin. The mcp__ prefix signals an external capability, while the server name identifies the owner. This structure allows Claude Code to route calls back to the correct server via tools/call requests without ambiguity, preventing external tools from silently shadowing built-in capabilities like Write.

Contract Ownership and Schema Preservation

A critical division of labor exists between the server and the client. The MCP server owns the semantic meaning of its tool, providing a human-readable description and a JSON Schema for inputs. Claude Code preserves this contract, wrapping it in the namespaced identity rather than translating it into a proprietary format. This design ensures that the model receives a coherent tool definition regardless of whether the capability originated locally or from a remote service. For server authors, this places the burden on them to provide precise descriptions and schemas, as the client’s wrapper cannot clarify vague server-side definitions.

Dynamic Tool Lists and Unified Abstraction

The integration is not static. MCP servers can advertise the listChanged capability, sending notifications when their tool inventory updates. Claude Code handles these refreshes dynamically within interactive sessions and via the Agent SDK, maintaining a cached view that can be invalidated without requiring a manual reconnection. This allows a server to gain or lose tools mid-session seamlessly. Ultimately, the client presents a unified tool surface where the model evaluates all capabilities—built-in or external—against the user’s request, hiding the underlying transport and routing machinery behind a consistent abstraction.

Key Takeaways

  • Claude Code uses mcp____ naming to prevent collisions between external and built-in tools.
  • The server owns the tool's schema and description; the client owns the routing, namespacing, and safety controls.
  • Dynamic tool list updates are supported via listChanged notifications, allowing servers to modify capabilities mid-session.
  • The unified tool surface hides transport complexity, presenting a coherent interface to the model regardless of tool origin.

The Bottom Line

Claude Code’s namespacing strategy is a necessary evolution for agent reliability, effectively turning MCP from a loose collection of endpoints into a secure, auditable tool ecosystem. While this places a higher quality bar on server developers to maintain precise schemas, it is the only way to scale agentic workflows without catastrophic tool collisions.