{"version":"2.1.301","anchor":"sdk-mcp-servers-can-carry-per-tool-permission-policy-via-mcp","canonical_anchor":"sdk-mcp-servers-can-carry-per-tool-permission-policy-via-mcp","heading":"SDK MCP servers can now carry a per-tool permission policy","tier":"use","area":"SDK","scope":"individual","heads_up":false,"url":"https:\/\/changelogs.core-directive.com\/v\/2.1.301\/e\/sdk-mcp-servers-can-carry-per-tool-permission-policy-via-mcp","release_url":"https:\/\/changelogs.core-directive.com\/v\/2.1.301","markdown":"### SDK MCP servers can now carry a per-tool permission policy\n\nPrograms hosting Claude Code can set ask or deny rules for individual tools on their in-process MCP servers, at initialize or via mcp_set_servers\n\n**What**\n\nAn MCP server is an add-on that gives Claude extra tools. A program that embeds Claude Code through the SDK (the developer kit for building on Claude Code) can register its own in-process MCP servers, called `sdk` servers. Each of these servers can now carry a `tools` setting, a per-tool permission policy that says how each of its tools is treated:\n\n- `always_ask`: the host program is asked before every call to that tool, even where an allow rule already covers it.\n\n- `always_deny`: calls to that tool are refused.\n\n- `always_allow` and `org_max_permission`: ignored on `sdk` servers. Only `always_ask` and `always_deny` take effect for them.\n\n- Where it is read: from `initialize` (in `sdkMcpServerConfigs`) and from `mcp_set_servers`.\n\n- `initialize`: each one that names the server adds ask and deny rules. An `initialize` never removes a rule. If the server is already registered, a different timeout or `disableAutoBackground` is still ignored, but a new `tools[]` is applied, and the log says so.\n\n- `mcp_set_servers`: replaces the rules. It now notices changes to `tools` on servers that are already registered, logs whether the policy was cleared or replaced, updates the live setting, and reports keys it does not support.\n\n- Malformed entries: entries in a `tools[]` list that are malformed are dropped, and an invalid `permission_policy` is read as `always_ask`. Invalid `tools[]` entries get their own error message instead of the generic \"ignoring invalid\" log.\n\n- New log line: `[Query] MCP server '<name>': ignoring malformed <field> in its config`, with a more specific reason when the field is `tools`.\n\nBefore, the settings for an `sdk` server were applied only when it was first registered, and `tools` was never read.\n\n**Why**\n\nA host program can now restrict individual tools on its own MCP servers, and change those restrictions after a server is registered. A mistake in the `tools` setting leads to a warning in the log rather than the setting silently failing.\n\n- Area: SDK\n- Names: `mcp_set_servers`, `initialize`\n- Tier: Use it now\n- Useful: 5\/5\n- Signal: 3\/5\n- Scope: individual\n- Heads-up: no"}