Unclear Which MCP tools, in which state, get the new marker is not identified.
What
MCP tools are tools supplied by external servers through the Model Context Protocol. Some MCP tools are marked as requiring user interaction, so a person has to approve each use. This release widens that treatment:
- The
requires_user_interactiondescription for remote-control permission prompts now covers one more case. If an MCP server's name spells a claude.ai connector's key, and the server came from neither claude.ai nor whoever launched the session, you must open the session to answer. No grant keyed on the tool's name may answer it. Remote control means answering prompts for a session from somewhere other than the terminal it runs in. - When a
PermissionRequesthook answers a permission decision, Claude Code re-runs the tool's own permission check. Before, it did this only for tools withrequiresUserInteractionset. It now also does it for tools flagged by a new check. A hook is a command Claude Code runs automatically at set points. - A tool can now define
ignoresWholeToolAllowRule, so an allow rule covering the whole tool does not apply to it. This is set for MCP tools in some states, alongside the existingsuppressesAlwaysAllowRule.
Why
A server can be given a name that looks like a trusted claude.ai connector. Under these changes, a saved approval or a hook cannot approve that server's tools on your behalf. You may be asked directly for some MCP tools that used to be approved automatically.
Something disagreesSomething we can check disagrees with this entry, or the writer said they could not settle it.
The writer flagged doubt
Which MCP tools, in which state, get the new marker is not identified.
Anthropic's release notes agree
Fixed hooks that run in PowerShell not blocking when the hook's program exits with code 2, and on Windows PreToolUse and PermissionRequest…