›_ Claude Code Issues
Claude Code Issues / #73052

[BUG] MCP permission wildcard rules (mcp__<server>__*) stopped matching — regression around v2.1.195, every MCP tool prompts again

Open 💬 0 comments Opened Jul 2, 2026 by mnk2002

Bug

MCP permission allow rules using the documented wildcard form mcp__<server>__* stopped matching. Every MCP tool call now triggers a permission prompt even though a matching wildcard rule exists in .claude/settings.local.json. These same rules had been working for months (last confirmed working late June 2026 on the then-current version).

The bare server form mcp__<server> still works, so this looks like a regression in rule matching rather than a settings-loading problem.

Environment

  • Claude Code 2.1.198 (native install, Windows 11)
  • Rules located in project .claude/settings.local.json → permissions.allow

Steps to reproduce

  1. Configure an MCP stdio server (e.g. tts) in .mcp.json.
  2. Add to .claude/settings.local.json:

``json
{
"permissions": {
"allow": [
"mcp__tts__*"
]
}
}
``

  1. Start a session and call any tool from that server (e.g. mcp__tts__say).

Expected: the call is auto-allowed — the permissions docs document this form: "Allow rules accept tool-name globs only after a literal mcp__<server>__ prefix. … mcp__puppeteer__* matches every tool from the puppeteer server."

Actual: a permission prompt appears for every MCP tool. Approving with "always allow" appends fully-qualified tool names (mcp__tts__say) to the allow list, which then work — so exact-name matching is fine, only the __* glob form is broken.

Workaround

Rewriting the rules to the bare server form works:

"mcp__tts"

Suspected cause

The v2.1.195 changelog entry:

Fixed hook matchers with hyphenated identifiers (e.g. code-reviewer, mcp__brave-search) accidentally substring-matching — they now exact-match.

If permission-rule matching shares that code path, the substring→exact-match fix would break the documented mcp__<server>__* glob as collateral damage. Timing fits: the rules worked until a late-June update.

Related

  • #34739 (older report of MCP wildcards not matching, closed as duplicate of #3107) — filing fresh per the auto-lock bot's instruction to open a new issue and reference it.

View original on GitHub ↗