SDK hosts can mark MCP tools that run code, so auto mode checks them

What

MCP tools are tools supplied by outside servers that Claude Code connects to. Programs that run Claude Code through the SDK, its programming interface, set it up with an initialize request. That request now accepts an internal field, codeRunningMcpTools:

• It maps each MCP server name to a list of tool names on that server that run code Claude wrote.
• Entries in the wrong shape are ignored with a warning. Valid entries cause Claude Code to rebuild its permission settings.
• In auto mode, where Claude Code approves actions on its own, a checker now judges calls to these tools.
• An allow answer from a PermissionRequest hook (a user command that decides on a permission question) no longer switches the permission mode for these tools.
• The initialize reply now includes code_running_mcp_tools_applied, and plugins_applied falls back to the value resolved earlier.
• The description of the file_attachments field adds a note about claude-code-server.

Why

An MCP tool that runs code could otherwise slip past auto mode's checks. Hosts can now declare such tools so their calls are judged like other code execution.