{"version":"2.1.309","anchor":"permission-hook-paths-now-also-treat-tools-flagged-by-a-new","canonical_anchor":"permission-hook-paths-now-also-treat-tools-flagged-by-a-new","heading":"More MCP tools now need a person to approve them, including lookalike claude.ai connectors","tier":"notice","area":"Hooks","scope":"individual","heads_up":true,"url":"https:\/\/changelogs.core-directive.com\/v\/2.1.309\/e\/permission-hook-paths-now-also-treat-tools-flagged-by-a-new","release_url":"https:\/\/changelogs.core-directive.com\/v\/2.1.309","markdown":"### More MCP tools now need a person to approve them, including lookalike claude.ai connectors\n\nMCP tools from servers named like claude.ai connectors, and other newly flagged tools, can no longer be approved by stored grants or hook shortcuts\n\n**Unclear.** Which MCP tools, in which state, get the new marker is not identified.\n\n**What**\n\nMCP tools are tools supplied by external servers through the Model Context Protocol. Some MCP tools are marked as requiring user interaction, so a person has to approve each use. This release widens that treatment:\n\n- The `requires_user_interaction` description for remote-control permission prompts now covers one more case. If an MCP server's name spells a claude.ai connector's key, and the server came from neither claude.ai nor whoever launched the session, you must open the session to answer. No grant keyed on the tool's name may answer it. Remote control means answering prompts for a session from somewhere other than the terminal it runs in.\n\n- When a `PermissionRequest` hook answers a permission decision, Claude Code re-runs the tool's own permission check. Before, it did this only for tools with `requiresUserInteraction` set. It now also does it for tools flagged by a new check. A hook is a command Claude Code runs automatically at set points.\n\n- A tool can now define `ignoresWholeToolAllowRule`, so an allow rule covering the whole tool does not apply to it. This is set for MCP tools in some states, alongside the existing `suppressesAlwaysAllowRule`.\n\n**Why**\n\nA server can be given a name that looks like a trusted claude.ai connector. Under these changes, a saved approval or a hook cannot approve that server's tools on your behalf. You may be asked directly for some MCP tools that used to be approved automatically.\n\n- Area: Hooks\n- Tier: You'll notice\n- Useful: 2\/5\n- Signal: 2\/5\n- Scope: individual\n- Heads-up: yes"}