MCP permission wildcards (mcp__*, mcp__server__*) don't auto-allow tools

Bug

MCP tool permission wildcards documented in https://code.claude.com/docs/en/permissions don't work. Users are still prompted for permission despite having matching wildcard rules in ~/.claude/settings.json.

Patterns tested (all failed to auto-allow)

• "*" — global wildcard, matches non-MCP tools but not MCP tools
• "mcp__*" — documented as catch-all for all MCP servers
• "mcp__cachebro__*" — documented as matching all tools from a server
• "mcp__cachebro" — documented as equivalent to mcp__cachebro__*

What works

Only fully qualified tool names auto-allow without prompting:

"mcp__cachebro__cache_status",
"mcp__cachebro__read_file",
"mcp__cachebro__read_files",
"mcp__cachebro__cache_clear"

Steps to reproduce

1. Add "mcp__cachebro__*" (or any wildcard form) to permissions.allow in ~/.claude/settings.json
2. Restart Claude Code
3. Use any cachebro MCP tool
4. Expected: tool runs without prompting
5. Actual: user is prompted for permission

Environment

• macOS (Darwin 25.3.0)
• Claude Code (native install)
• MCP servers configured in ~/.claude.json (user scope)
• No settings.local.json or project-level overrides
• /permissions UI confirms the wildcard rule is loaded with no conflicting ask/deny rules

Workaround

Enumerate every MCP tool explicitly in the allow list.