[BUG] Cloud MCP connectors (mcp__claude_ai_*) ignore permissions.allow — every call prompts for approval regardless of allowlist entries

Preflight Checklist

• [x] I have searched existing issues and this hasn't been reported yet
• [x] This is a single bug report (please file separate reports for different bugs)
• [x] I am using the latest version of Claude Code

What's Wrong?

cloud MCP connectors (mcp__claude_ai_*) ignore permissions.allow entries entirely — every call prompts regardless of whether the tool name is listed, even with a wildcard. Local MCP servers (run via npx/uvx in mcpServers config) do respect the allow list; cloud connectors don't. That's the specific gap to call out.

This is occurring on ServiceNow getIncidents where it is prompting for each get request

What Should Happen?

either an allow for this session, or when added to permissions.allow - no prompting at all

Error Messages/Logs

Steps to Reproduce

1. Connect a cloud MCP server through claude.ai (e.g. the ServiceNow connector) — these appear as mcp__claude_ai_<ServerName>__<toolName> in Claude Code
2. Add the tool name to permissions.allow in ~/.claude/settings.json:

{
"permissions": {
"allow": [
"mcp__claude_ai_ServiceNow__getIncident",
"mcp__claude_ai_ServiceNow__listIncidents"
]
}
}

1. Also add the same entries to ~/.claude/settings.local.json (tried both files)
2. Also try a wildcard entry: "mcp__claude_ai_ServiceNow__*"
3. Restart Claude Code
4. In a session, call any of the listed tools (e.g. mcp__claude_ai_ServiceNow__listIncidents)
5. Observe: permission prompt still appears asking "Allow Claude to call this tool?" — every single call, every session

Expected: Tools listed in permissions.allow are auto-approved with no prompt, matching the behavior of local MCP servers and Bash commands in the same list.

Actual: Every call to a mcp__claude_ai_* cloud connector tool prompts for approval, regardless of allowlist configuration. In parallel batches (e.g. 36 simultaneous getIncident calls), each call generates its own prompt.

Claude Model

Sonnet (default)

Is this a regression?

Yes, this worked in a previous version

Last Working Version

_No response_

Claude Code Version

2.1.123 (Claude Code)

Platform

Anthropic API

Operating System

Windows

Terminal/Shell

PowerShell

Additional Information

_No response_