Connecting Claude Code safely: development only, an agent user, never production

Three rules come before any configuration file. Development only: Claude Code connects to CMD, never to CMQ or CMP, and never to the legacy ECC systems. An agent user: the ADT project the MCP server uses logs on as the developer's agent user, such as KENJI_AGT with role ZCMC_AGENT_DEV, so SAP's version history and Security Audit Log tell agent work from human work. Never production: not for reading, not for "just one query". The design of agent users and roles is covered in sap-aid-302, lesson 2; this lesson wires Claude Code to that design.

Before you connect

1. Sam (Basis) has created KENJI_AGT in CMD only; Nadia (security) has assigned ZCMC_AGENT_DEV.
2. In ADT for VS Code (or Eclipse), Kenji adds a second destination for CMD client 100 that logs on as KENJI_AGT. His normal destination stays for his own work.
3. He enables the ADT MCP server (VS Code default port 2236; Eclipse default 2234), keeps access restrictions on, lists only the agent project and the package ZCMC_CORE_AGREEMENT, and leaves the edit file tool off for the first session.
4. He copies the generated token into an environment variable, ADT_MCP_TOKEN, in his shell profile or secrets manager. The token never goes into a file in the repository.

Where Claude Code stores MCP servers

When the same server name exists in several scopes, Claude Code uses the whole entry from the highest one, local before project before user; fields aren't merged across scopes. An organization can also provide servers through managed settings, which rank above all of these.

Contoso's .mcp.json

The repository for the core agreement package carries one shared definition. Claude Code expands ${VAR} and ${VAR:-default} in a server's command, args, env, url and headers, so the file can be committed without the token:

If ADT_MCP_TOKEN isn't set, Claude Code still loads the file with a warning and sends the literal text, so the server rejects the call. That failure is safe and easy to spot in /mcp. The command-line alternative, claude mcp add --transport http --scope local adt http://localhost:2236/mcp --header "Authorization: Bearer $ADT_MCP_TOKEN", works too, but your shell expands the variable when you run it, so the token value is written into ~/.claude.json. That's acceptable for local scope on an encrypted laptop; never do it with --scope project. Remember that the token changes whenever someone regenerates it in the IDE.

Verify the connection

• Start Claude Code in the repository. In an interactive session it asks you to approve project-scoped servers from .mcp.json before using them; approve adt. (claude mcp reset-project-choices resets those choices.)
• Run /mcp. It shows each server's status and tool count. A failed adt usually means the IDE isn't running, the server isn't enabled, the port differs or the token variable is missing.
• Outside a session, claude mcp list and claude mcp get adt show the same status.
• Note that claude -p (headless) runs load project servers without asking. That's one reason lesson 4 uses --bare for scripted runs.

Pin the permission mode

Anthropic's security page says auto mode, in which a classifier reviews actions instead of you, is now the built-in starting mode for interactive terminal and VS Code sessions. For SAP work Contoso wants a person to approve each change, so it pins permissions.defaultMode: "default" (labeled Manual) in managed settings. That matters because the VS Code extension ignores project settings for the starting mode; it reads its own claudeCode.initialPermissionMode setting, then managed or user settings. The repository's .claude/settings.json repeats "defaultMode": "default" for terminal sessions and disables bypass mode. sap-aid-302 covers the managed layer. Use plan mode when you only want analysis: Claude reads and explores but doesn't edit source files. Lesson 4 builds the full settings file.

The smoke test

The first session changes nothing. It answers one practical question: which ADT tools work against your backend? Give Claude Code read-only tasks and watch which tools it calls: