Default strict_mcp_config to true

[camysidron1]

Summary

• default ClaudeAgentOptions.strict_mcp_config to True
• keep ambient MCP discovery available through the explicit False opt-out
• document the default and migration path
• test both the secure default and compatibility opt-out

Why

SDK applications commonly run with a working directory that is not itself trusted application configuration. With the current default, Claude Code may implicitly load and start MCP servers from project .mcp.json, user/global settings, or plugins in addition to the servers supplied through mcp_servers.

Defaulting to strict mode makes the SDK's MCP server set explicit and deterministic. Programmatically supplied MCP servers continue to work unchanged.

Compatibility

This changes behavior for applications that intentionally rely on ambient MCP discovery. They can retain the previous behavior with:

ClaudeAgentOptions(strict_mcp_config=False)

Testing

• python -m pytest tests/ — 1291 passed, 5 skipped
• python -m ruff check src/ tests/ scripts/
• python -m ruff format --check src/ tests/ scripts/
• python -m mypy src/ scripts/