lsof is a command that lists open files and network connections. Claude Code normally lets it run without asking you, because it only reads information. That no longer holds in one case: a bare -i followed by an argument that contains ~. Such a command now counts as dangerous and waits for your approval.
Why
In a shell, ~ can expand to a home directory path. An argument using it is not always the plain read-only request it looks like, so Claude Code now checks with you first.
How sure we are
One source agreesOne thing we can check says the same as this entry.
Anthropic's release notes agreeImproved screen-reader output in /mcp: a disabled server is read as "off" instead of "pending"
