macOS TCC permission prompt ("node would like to access data from other apps") on every launch and first message

Summary

On macOS, a privacy prompt — "node" would like to access data from other apps — appears repeatedly despite the user clicking Allow and having Automation toggled on in System Settings. Granting Full Disk Access to Claude.app reduces but does not eliminate the prompts.

Behavior

1. On launch, one or more macOS TCC permission prompts appear for node.
2. After granting Full Disk Access to Claude.app, the launch-time prompts stop — but a second prompt fires on the first message sent in a new session.
3. Clicking Allow in System Settings → Privacy & Security → Automation does not prevent the prompt from recurring on the next launch.

Root Cause (observed)

Every MCP server is spawned via a disclaimer helper binary:

/Applications/Claude.app/Contents/Helpers/disclaimer /opt/homebrew/bin/node <mcp-server-args>

macOS TCC ties the permission grant to the requesting process. Because disclaimer is the intermediary, granting permission to node in Automation settings doesn't satisfy future requests from the disclaimer-wrapped processes. The TCC entry doesn't persist reliably across sessions for this process hierarchy.

Additionally, at least one MCP server is spawned lazily (on first user message rather than at app launch), which causes a second prompt mid-session even after the launch-time prompts are resolved.

Steps to Reproduce

1. Install Claude Code on macOS
2. Configure one or more MCP servers
3. Launch Claude Code — observe macOS permission prompt for node
4. Click Allow; toggle Automation on in System Settings
5. Quit and relaunch — prompt reappears
6. Grant Full Disk Access to Claude.app — launch prompt stops, but a prompt still fires on first message sent

Expected Behavior

Permission should be granted once and persist. No repeated TCC prompts after initial approval.

Suggested Fixes

• Remove or replace the disclaimer wrapper so node is the direct process — macOS can then persist the Automation permission normally.
• Or: spawn all MCP servers at launch (not lazily) so any prompts fire before the user starts typing, and bundle them under Claude.app's existing entitlements.
• Or: use a properly code-signed and entitled helper that macOS TCC can track persistently across sessions.

Environment

• macOS Darwin 25.3.0
• Claude Code (claude-sonnet-4-6)
• MCP servers: noteplan, filesystem, and others
• Node path: /opt/homebrew/bin/node