claude -p with --tools "" burning 400k tokens per call: how to cut it with --strict-mcp-config

You run Claude Code from a script with claude -p --tools "", assuming that with no tools the call stays light. With a subscription login and claude.ai connectors active, the opposite happens: one user measured 429,388 input tokens per call for a one-line prompt (issue anthropics/claude-code #106413, Claude Code 2.1.312, 2026-10-31). The fix is one flag: --strict-mcp-config brought the same test down to 2,854 tokens.

Why does claude -p --tools "" use so many tokens?

Because --tools "" also removes the ToolSearch tool, and without it Claude Code loads the full definition of every MCP tool upfront instead of fetching them on demand. The official docs say so in Configure tool search: "If you deny ToolSearch or leave it out of --tools, MCP tools load upfront instead."

The second ingredient is the claude.ai connectors (Gmail, Slack, Drive and so on). According to the same page, they are only fetched when the active authentication is a claude.ai subscription login. With ANTHROPIC_API_KEY, ANTHROPIC_AUTH_TOKEN or apiKeyHelper active, they are not loaded.

The flag name is a trap: the CLI reference warns that --tools "doesn't affect MCP tools". It restricts the built-in tools. MCP tools are still there, now loaded in full.

How much does each setup cost, measured?

The numbers below come from the author of issue #106413 (Claude Code 2.1.312, subscription login, same one-line prompt, input tokens including cache) and from a second user who reproduced it on a Mac with 2.1.316 and Haiku. They are not our own measurements.

Setup	Input tokens	Source
claude -p --tools ""	429,388	issue author
+ --strict-mcp-config	2,854	issue author
ENABLE_CLAUDEAI_MCP_SERVERS=false, no strict	2,854	issue author
--strict-mcp-config --mcp-config with 1 own server	3,326	issue author
plain claude -p	~60k	second user
claude -p --tools ""	~276k	second user
claude -p --tools "" --strict-mcp-config	~5k	second user

The takeaway: with plain claude -p, connectors only cost their names, because tool search is on. It is the combination of --tools "" plus connectors that blows up. The total depends on how many connectors your account has, so measure your own case before comparing.

How do you measure how many tokens your call uses?

Use --output-format json and read the usage block of the response. Add input, cache creation and cache read, which is how the issue measured it:

claude -p "reply OK" --tools "" --output-format json \
  | jq '.usage | .input_tokens + .cache_creation_input_tokens + .cache_read_input_tokens'

Run the same line with and without --strict-mcp-config. If the difference is in the hundreds of thousands, you are in the case this article covers. To see which servers are connected, /mcp in interactive mode lists each one and marks the ones that come from claude.ai.

How do you drop the connectors in a call that uses no tools?

Add --strict-mcp-config. The flag makes Claude Code use only the servers passed in --mcp-config, and since you passed none, you get zero. In the -p code path, fetching the claude.ai connectors is also skipped when the flag is present.

claude -p "classify this text: ..." \
  --tools "" \
  --strict-mcp-config \
  --output-format json

It is the fix the issue author adopted in their own program.

What if the script needs its own MCP server?

You have two documented options, depending on what you want to keep.

• Only the server the script uses: --strict-mcp-config together with --mcp-config pointing to a file with that server. In the issue's measurement, this cost 472 tokens more than plain strict, which is the weight of that server's tool.
• All your servers, without the claude.ai connectors: turn off only the connectors, through an environment variable or a setting.

# a single server
claude -p "..." --tools "" --strict-mcp-config --mcp-config ./one-server.json

# your servers, without the claude.ai connectors (applies to the shell session)
ENABLE_CLAUDEAI_MCP_SERVERS=false claude -p "..." --tools ""

To make it permanent, the official docs (Disable claude.ai connectors) point to the key below in any settings scope. Servers passed via --mcp-config are unaffected.

{
  "disableClaudeAiConnectors": true
}

If the problem is MCP tools in general rather than the connectors, the CLI reference documents --disallowedTools "mcp__*", which removes every MCP tool from the context. That option was not measured in the issue.

Why not use --bare?

Because --bare does not use your subscription login. It skips hooks, skills, plugins, MCP servers, memory and CLAUDE.md, and the official docs (headless) recommend it for scripts. But in bare mode Claude Code "never reads OAuth credentials", so it requires ANTHROPIC_API_KEY and bills through the API. If you want to run scripts inside your subscription, --strict-mcp-config is the way.

How do you keep this from coming back after an update?

Put a ceiling in the script itself. The suggestion that came out of the issue thread: compare each call's input tokens against the normal range for that kind of call and alert when it goes over. A minimal shell example:

TOKENS=$(claude -p "$PROMPT" --tools "" --strict-mcp-config --output-format json \
  | jq '.usage | .input_tokens + .cache_creation_input_tokens + .cache_read_input_tokens')
if [ "$TOKENS" -gt 30000 ]; then
  echo "alert: call used $TOKENS input tokens" >&2
fi

The issue author uses 30k as the ceiling for calls that normally use about 2.5k. Tune it to your case. The point is that an update that starts loading something new shows up the same day, not three days of quota later.