{"version":"2.1.323","anchor":"mcp-serve-tool-host-ask-directory-pinning-behind-tengu-quiz","canonical_anchor":"mcp-serve-tool-host-ask-directory-pinning-behind-tengu-quiz","heading":"claude mcp serve can tie a command to the folder it was approved in","tier":"soon","area":"MCP Server Mode","scope":"individual","heads_up":false,"url":"https:\/\/changelogs.core-directive.com\/v\/2.1.323\/e\/mcp-serve-tool-host-ask-directory-pinning-behind-tengu-quiz","release_url":"https:\/\/changelogs.core-directive.com\/v\/2.1.323","markdown":"### claude mcp serve can tie a command to the folder it was approved in\n\nWhen Claude Code runs as an MCP server, a command can now run in the folder where it was approved, if that folder is unchanged\n\n**Unclear.** It is unclear whether a launch deny or ask rule starting with `!` is now ignored or acts as an exception to the rules listed before it, and whether that part is also switched on remotely.\n\n**What**\n\nClaude Code can act as an MCP server, a tool host that other programs connect to and use. When it asks you to approve a command, it now records which folder the approval was given in, along with a fingerprint of that folder. A later request to run the command can then be sent back to that approved folder, but only if the folder still matches its fingerprint. A run can also be refused with the reason `ask_changed`.\n\nThe folder part is off unless it is switched on remotely.\n\nThere is also a new rule filter. Deny and ask rules given when Claude Code is launched that start with `!` are now handled differently from other rules.\n\n**Why**\n\nIt closes a gap where the working folder could change between the moment you approved a command and the moment it ran, so the command could run somewhere you did not approve.\n\n- Flag `tengu_quizzical_locket`: Off in both readings (read for one account on one subscription tier against v2.1.323; this account: off, anonymous baseline: off, compiled default: off) These values were read against a different version of Claude Code, so treat them as the nearest reading available instead of one taken on this release.\n- Area: MCP Server Mode\n- Names: `claude mcp serve`\n- Tier: Nothing to try yet\n- Useful: 2\/5\n- Signal: 3\/5\n- Scope: individual\n- Heads-up: no\n- Present in the build but not switched on"}