{"version":"2.1.312","anchor":"permission-prompts-for-mcp-skills-file-rule-messages-and-no","canonical_anchor":"permission-prompts-for-mcp-skills-file-rule-messages-and-no","heading":"New permission messages for commands whose file access can't be checked","tier":"soon","area":"Permissions","scope":"individual","heads_up":false,"url":"https:\/\/changelogs.core-directive.com\/v\/2.1.312\/e\/permission-prompts-for-mcp-skills-file-rule-messages-and-no","release_url":"https:\/\/changelogs.core-directive.com\/v\/2.1.312","markdown":"### New permission messages for commands whose file access can't be checked\n\nNew permission messages cover commands whose opened files can't be identified, and \"always allow\" suggestions differ for MCP skills\n\n**Unclear.** Which hosts or commands lead to these new messages is not stated.\n\n**What**\n\nClaude Code has three new permission messages for when it cannot tell which files a command opens on a host (the machine the command runs on):\n\n- Two ask you first before the command runs.\n\n- One refuses the command outright when managed deny rules apply. Managed rules are permission rules set by an organisation's administrator.\n\nThe suggestions Claude Code offers for adding an allow rule are also handled differently when the request comes from an MCP skill. An MCP skill is a skill provided through an MCP server, which is an outside service that adds tools to Claude Code.\n\nThis sits behind the same server-controlled setting that already affected the \"always allow\" choice in permission prompts. It is off unless it is switched on remotely.\n\n**Why**\n\nThis tightens how commands from forwarded MCP skills get approved, especially when Claude Code cannot see which files they will touch.\n\n- Flag `tengu_valiant_crayon`: Not enough to say (read for one account on one subscription tier against v2.1.312; this account: no value returned, anonymous baseline: no value returned, compiled default: off) These values were read against a different version of Claude Code, so treat them as the nearest reading available instead of one taken on this release.\n- Area: Permissions\n- Tier: Nothing to try yet\n- Useful: 2\/5\n- Signal: 3\/5\n- Scope: individual\n- Heads-up: no"}