You'll notice
Useful3 Signal2
Permission prompts now recognise MCP tools by name even when the server isn't loaded.
What's wrong with this entry?
Anonymous. No account, no email.
What
When Claude Code builds a placeholder for a tool name it does not have loaded, it now decides whether the tool is an MCP tool from the mcp__ name prefix instead of always answering no. Permission rendering and rule matching now treat those names as MCP tools even when the real tool is unavailable.
Evidence
mcp__
Strings lifted out of the shipped bundle, so the claim above can be checked against them.