[BUG] Wildcard permission `mcp__plugin_github_github(*)` does not match plugin MCP tools

Preflight Checklist

• [x] I have searched existing issues and this hasn't been reported yet
• [x] This is a single bug report (please file separate reports for different bugs)
• [x] I am using the latest version of Claude Code

What's Wrong?

I have "mcp__plugin_github_github(*)" in my global ~/.claude/settings.json allow list:

{
  "permissions": {
    "allow": [
      "mcp__plugin_github_github(*)"
    ]
  }
}

Despite this wildcard, Claude Code still prompts for permission when using individual GitHub plugin tools like mcp__plugin_github_github__get_file_contents:

Tool use
  plugin:github:github - Get file or directory contents(owner: "grafana", repo: "flint", path: "...") (MCP)

Do you want to proceed?
  1. Yes
❯ 2. Yes, and don't ask again for plugin:github:github - Get file or directory contents commands in /home/gregor/.claude
  3. No

The wildcard (*) should match all tools under mcp__plugin_github_github, but it doesn't seem to be evaluated correctly for plugin-based MCP tools.

What Should Happen?

The wildcard mcp__plugin_github_github(*) should match all tools under that MCP server prefix (e.g., mcp__plugin_github_github__get_file_contents, mcp__plugin_github_github__search_issues, etc.) and not prompt for permission.

Error Messages/Logs

N/A - no error, just unexpected permission prompt

Steps to Reproduce

1. Add "mcp__plugin_github_github(*)" to ~/.claude/settings.json under permissions.allow
2. Enable the GitHub plugin
3. Use any GitHub plugin tool (e.g., get file contents)
4. Observe that permission is still requested despite the wildcard

Claude Model

Opus

Is this a regression?

I don't know

Last Working Version

_No response_

Claude Code Version

2.1.52

Platform

Anthropic API

Operating System

Linux (Ubuntu-based)

Terminal/Shell

zsh

Additional Information

Possibly related to #9280 but this is specifically about the wildcard pattern not matching plugin MCP tools. Non-plugin MCP wildcards may or may not have the same issue.