{"version":"2.1.299","anchor":"mcp-allow-rules-now-only-match-when-the-servers-tool-covera","canonical_anchor":"mcp-allow-rules-now-only-match-when-the-servers-tool-covera","heading":"MCP allow rules no longer approve tools from a different MCP server","tier":"notice","area":"Permissions","scope":"both","heads_up":true,"url":"https:\/\/changelogs.core-directive.com\/v\/2.1.299\/e\/mcp-allow-rules-now-only-match-when-the-servers-tool-covera","release_url":"https:\/\/changelogs.core-directive.com\/v\/2.1.299","markdown":"### MCP allow rules no longer approve tools from a different MCP server\n\nMCP allow rules are matched more strictly, and Claude Code warns when one cannot approve a tool from another MCP server\n\n**Unclear.** It is not clear whether an allow rule that matched before this change will now prompt instead.\n\n**What**\n\nPermission rules decide which tools Claude Code may run without asking you. They can allow a tool, deny it, or ask about it. Claude Code has changed how these rules are matched against MCP tools, which are tools supplied by outside programs called MCP servers.\n\n- Allow rules: now only match when the rule covers the tool's own MCP server, and the rule name must also match the tool.\n\n- Deny and ask rules: also match when the rule names the MCP server.\n\nWhen an allow rule does not cover a tool that belongs to another MCP server, Claude Code logs a warning, once for each tool name. The warning suggests writing the rule as `server*` or using the tool's full name.\n\n**Why**\n\nTools that used to run without a prompt may now ask for permission. If you see that warning, rewrite the rule in the `server*` form or name the tool in full.\n\n- Area: Permissions\n- Tier: You'll notice\n- Useful: 3\/5\n- Signal: 2\/5\n- Scope: both\n- Heads-up: yes"}