MCP Tool-Level Permission Policies / Claude Code v2.1.191

What

Individual MCP tools can now declare a permission_policy in the MCP server config, allowing fine-grained pre-authorization without manual approval prompts.

Usage

Set permission_policy on any tool entry in your MCP server configuration:

{
  "mcpServers": {
    "myserver": {
      "type": "http",
      "url": "http://localhost:3000",
      "tools": [
        { "name": "read_db",  "permission_policy": "always_allow" },
        { "name": "write_db", "permission_policy": "always_ask"  },
        { "name": "drop_db",  "permission_policy": "always_deny" }
      ]
    }
  }
}

Details

Accepted values: always_allow, always_ask, always_deny.
Policies are translated to mcpServerPolicy entries in the effective allow/ask/deny rule sets.
Only applies to http and sse transport types; stdio tools are unaffected.
Overrides the default prompt-based approval flow for that specific tool.

Evidence

MCP permission policy resolver (search for "permission_policy" alongside "always_allow")

Strings lifted out of the shipped bundle, so the claim above can be checked against them.