Your continuous integration job runs Claude Code non-interactively in a repository whose configuration defines two MCP servers. Nobody approved them on the build machine. What happens on that run?

The principle — A protection that works by asking a person stops working when no person is present. What matters is which way it fails.

Why the key is correct — The documentation is explicit that headless runs, Agent SDK sessions and cloud sessions cannot show that prompt, and that Claude Code loads project-scoped servers there without asking. The gate fails open rather than closed, so every server the repository defines is live on that build.

Why the others are wrong — Nothing is refused for safety. No approval is inherited from a developer's machine, because approvals do not travel. And there is no pause or queue waiting for an answer that will never come.

Remember this — In automation the approval prompt is not a weaker protection, it is an absent one, and every server the repository defines loads regardless. Decide what you want loaded there before the job runs, not after.

Sources — Anthropic's Claude Code MCP reference.