More MCP tools now need a person to approve them, including lookalike claude.ai connectors

What

MCP tools are tools supplied by external servers through the Model Context Protocol. Some MCP tools are marked as requiring user interaction, so a person has to approve each use. This release widens that treatment:

• The requires_user_interaction description for remote-control permission prompts now covers one more case. If an MCP server's name spells a claude.ai connector's key, and the server came from neither claude.ai nor whoever launched the session, you must open the session to answer. No grant keyed on the tool's name may answer it. Remote control means answering prompts for a session from somewhere other than the terminal it runs in.
• When a PermissionRequest hook answers a permission decision, Claude Code re-runs the tool's own permission check. Before, it did this only for tools with requiresUserInteraction set. It now also does it for tools flagged by a new check. A hook is a command Claude Code runs automatically at set points.
• A tool can now define ignoresWholeToolAllowRule, so an allow rule covering the whole tool does not apply to it. This is set for MCP tools in some states, alongside the existing suppressesAlwaysAllowRule.

Why

A server can be given a name that looks like a trusted claude.ai connector. Under these changes, a saved approval or a hook cannot approve that server's tools on your behalf. You may be asked directly for some MCP tools that used to be approved automatically.