{"version":"2.1.321","anchor":"plugin-toolcheck-hook-can-tighten-tool-permissions","canonical_anchor":"plugin-toolcheck-hook-can-tighten-tool-permissions","heading":"Plugins can now make tool permissions stricter, but never looser","tier":"use","area":"Plugins","scope":"individual","heads_up":false,"url":"https:\/\/changelogs.core-directive.com\/v\/2.1.321\/e\/plugin-toolcheck-hook-can-tighten-tool-permissions","release_url":"https:\/\/changelogs.core-directive.com\/v\/2.1.321","markdown":"### Plugins can now make tool permissions stricter, but never looser\n\nA new `tool.check` hook lets plugins answer allow, deny or ask on a tool check, and only stricter answers take effect for built-in tools\n\n**Unclear.** Whether the plugin system that runs this hook is switched on by default is not known.\n\n**What**\n\nPlugins can now take part in permission checks through a new `tool.check` hook. A plugin is an add-on that extends Claude Code. A hook is an event that a plugin can respond to. When Claude Code checks whether a tool may run, a plugin can now answer allow, deny or ask.\n\nFor built-in tools and some MCP tools, Claude Code limits what a plugin's answer can do. MCP tools are tools that come from outside services connected to Claude Code. For these tools Claude Code ignores:\n\n- any allow answer from a plugin\n\n- any plugin answer at all when Claude Code's own permission check has already denied the tool\n\nWhen Claude Code ignores a plugin's answer, it records that it kept its own decision, and that plugins can only make that tool's permission stricter in this session.\n\n**Why**\n\nPlugins now have a way to add extra caution to tool use, such as asking first or blocking a tool. They cannot use this hook to quietly grant a built-in tool more access than your own permission settings give it.\n\n- Area: Plugins\n- Names: `tool.check`\n- Tier: Use it now\n- Useful: 5\/5\n- Signal: 4\/5\n- Scope: individual\n- Heads-up: no"}