Request for more technical documentation on allowedTools wildcards and local config storage

I'd like clearer info in the docs on the config of allowedTools, and where MCP "local" configs are stored.

I'll walk through my use cases to clarify where I'm getting stuck.

Allow claude-code to open certain urls for me

In this use case, I'm requesting a workflow that ends with the github new PR page being opened. On mac, it's something like:
open https://github.com/foo/bar/pull/new/branchnamehere

the branchname is task-dependent, and I'd like to be cautious about which URLs claude-code can open for safety reasons.

I tried both of these commands:

claude config add allowedTools "Bash(open https://github.com/foo/bar/pull/new:*)"
claude config add allowedTools "Bash(open https://github.com/foo/bar/pull/new*)"

I even tried claude config add allowedTools "Bash(open *github.com/melengoteam/tailormade-v2/pull/new*)", in case the : in https: was the problem.

So clearly I'm confused.
Is the :* implying that the args can be wildcards, but you cannot put a wildcard at the end of a given command arg? Why the :?

cp -a a repo directory doesn't pull in the MCP config (local)

I setup a MCP server via claude mcp add, and chose local. Where did that config go? It doesn't appear to be any hidden variable in the directory, and I'm not seeing it in ~/Library/Application Support. Since I often have to give env vars for these servers to work, it would be nice to know where this kind of config ends up.

Sometimes I like to work on multiple branches with unstaged commits for each on the same computer, so I was looking for a clean way to copy over the allowedTools and MCP configs. Project-specific personal dotfiles.