Unclear It is not shown what Claude Code does with a call once it is marked as allowed by the server.
MCP servers are outside programs that give Claude Code extra tools. Some are supplied by a program built on the SDK, Anthropic's toolkit for building on Claude Code. An MCP server's settings can now include autoModeVerdictTools, a list of tool names.
In auto mode, a check on Anthropic's servers decides whether a tool call is safe to run. A call to a listed tool is marked as allowed by the server when all of these hold:
- the tool comes from an SDK-supplied server and is on the list
- the server-side check approved the call
- the call is the model's own, and its inputs match exactly what the model asked for
Otherwise the call is not marked, and Claude Code records why. Reasons include the feature being switched off, the call not being the model's own, and the inputs differing from the model's request. The feature is also behind a remote switch that defaults to on when the server sends nothing.
If you build on the SDK with your own MCP tools, this can save asking for permission a second time on a call the server has already approved. Requiring an exact match on the inputs keeps a changed call from riding on that approval.
It is not shown what Claude Code does with a call once it is marked as allowed by the server.