SDK MCP servers can now carry a per-tool permission policy

What

An MCP server is an add-on that gives Claude extra tools. A program that embeds Claude Code through the SDK (the developer kit for building on Claude Code) can register its own in-process MCP servers, called sdk servers. Each of these servers can now carry a tools setting, a per-tool permission policy that says how each of its tools is treated:

• always_ask: the host program is asked before every call to that tool, even where an allow rule already covers it.
• always_deny: calls to that tool are refused.
• always_allow and org_max_permission: ignored on sdk servers. Only always_ask and always_deny take effect for them.
• Where it is read: from initialize (in sdkMcpServerConfigs) and from mcp_set_servers.
• initialize: each one that names the server adds ask and deny rules. An initialize never removes a rule. If the server is already registered, a different timeout or disableAutoBackground is still ignored, but a new tools[] is applied, and the log says so.
• mcp_set_servers: replaces the rules. It now notices changes to tools on servers that are already registered, logs whether the policy was cleared or replaced, updates the live setting, and reports keys it does not support.
• Malformed entries: entries in a tools[] list that are malformed are dropped, and an invalid permission_policy is read as always_ask. Invalid tools[] entries get their own error message instead of the generic "ignoring invalid" log.
• New log line: [Query] MCP server '<name>': ignoring malformed <field> in its config, with a more specific reason when the field is tools.

Before, the settings for an sdk server were applied only when it was first registered, and tools was never read.

Why

A host program can now restrict individual tools on its own MCP servers, and change those restrictions after a server is registered. A mistake in the tools setting leads to a warning in the log rather than the setting silently failing.