Add explicit documentation that MCP permissions do not support wildcards

Summary

The Claude Code documentation does not explicitly state that wildcard syntax (*) is
not supported for MCP permissions. This omission causes confusion as users naturally
expect wildcards to work as they do for other permission types.

The Problem

1. Wildcards work for other permissions, leading to reasonable user expectations:

"Bash(npm run:*)" // ✅ Works
"WebFetch(domain:*.github.com)" // ✅ Works

1. Users naturally try the same pattern for MCP:

"mcp__github__*" // ❌ Does NOT work (but nothing says it won't)
"mcp__mongodb__*" // ❌ Does NOT work (but seems logical)

1. Current documentation doesn't mention this limitation, causing users to:

• Spend time debugging "broken" permissions
• File bug reports (like #3107)
• Add redundant permission entries

Evidence of User Confusion

• Issue #3107: User reported wildcards "not being honored" as a bug
• The issue had to be closed with Anthropic staff explaining: "Permission rules do not

support wildcards"

• This indicates the limitation is non-obvious and needs explicit documentation

Requested Addition

Add clear documentation in the
https://docs.anthropic.com/en/docs/claude-code/iam#permission-modes stating:

⚠️ Note: Unlike other permission types, MCP permissions do NOT support wildcards (*).

To approve all tools from an MCP server:

• ✅ Use: "mcp__github" (approves ALL GitHub tools)
• ❌ Don't use: "mcp__github__*" (wildcards are not supported)

To approve specific tools only, list each one:

• ✅ Use: "mcp__github__get_issue"
• ✅ Use: "mcp__github__list_issues"

Benefits

Adding this clarification will:

• Prevent user confusion and wasted debugging time
• Reduce bug reports about "broken" wildcard permissions
• Clarify the intentional design difference between MCP and other permission types
• Help users configure permissions correctly the first time

References

• Issue #3107 - Example of user confusion due to missing documentation
• Current https://docs.anthropic.com/en/docs/claude-code/iam#permission-modes -

Explains MCP syntax but doesn't mention wildcard limitation