{"version":"2.1.318","anchor":"mcp-file-delivery-permission-cards-gated-by-tengu-walnut-til","canonical_anchor":"hook-attachment-visibility-predicate-replaces-mcp-file-card","heading":"The permission prompt for MCP tools that can send your files elsewhere was reworked","tier":"notice","area":"MCP","scope":"individual","heads_up":true,"url":"https:\/\/changelogs.core-directive.com\/v\/2.1.318\/e\/mcp-file-delivery-permission-cards-gated-by-tengu-walnut-til","release_url":"https:\/\/changelogs.core-directive.com\/v\/2.1.318","markdown":"### The permission prompt for MCP tools that can send your files elsewhere was reworked\n\nClaude Code's check that asks before an MCP tool sends session files elsewhere moved into new logic, with a separate check for unasked turns\n\n**Unclear.** Which MCP servers' tools count as able to send session files elsewhere is not stated.\n\n**What**\n\nMCP servers are outside programs that give Claude extra tools. Some of those tools can send files from your session somewhere else. Claude Code asks you before using them, with a message like \"can send this session's files elsewhere, so Claude asks before using it. Allow it if you expected this.\"\n\n- The function that held this check before now holds something else: a check for whether a hook's attachment should be shown. A hook is a command you configure to run at set points.\n\n- The same ask now appears in new permission logic that wraps MCP tools able to send session files elsewhere.\n\n- The new logic has a separate check for turns where you were not asked (`mcp_unasked_turn`).\n\n- File delivery is controlled by two remote switches, `tengu_walnut_tiller` and `tengu_sprightly_orbit`.\n\n- In readings taken before this release, Anthropic's servers returned `tengu_walnut_tiller` on for this site's account and for a signed-out baseline. No reading has been taken under this release. Nothing has been read about `tengu_sprightly_orbit`.\n\n**Why**\n\nThe ask before an MCP tool moves your files appears to have been moved rather than removed. The agent that found the new logic expects tools that move files to ask for permission more often. Watch for these prompts if you use MCP tools that upload or deliver files.\n\n- Flag `tengu_walnut_tiller`: On for this account, and not off by default (read for one account on one subscription tier against v2.1.318; this account: on, anonymous baseline: on, compiled default: on) These values were read against a different version of Claude Code, so treat them as the nearest reading available instead of one taken on this release.\n- Flag `tengu_sprightly_orbit`: Not enough to say (read for one account on one subscription tier against v2.1.318; this account: no value returned, anonymous baseline: no value returned, compiled default: on) These values were read against a different version of Claude Code, so treat them as the nearest reading available instead of one taken on this release.\n- Area: MCP\n- Tier: You'll notice\n- Useful: 3\/5\n- Signal: 3\/5\n- Scope: individual\n- Heads-up: yes"}