Google Drive connector re-prompts for “Download file content” despite permission set to “Always allow”

Preflight Checklist

• [x] I have searched existing issues and this hasn't been reported yet
• [x] This is a single bug report (please file separate reports for different bugs)
• [x] I am using the latest version of Claude Code

What's Wrong?

Summary:
The Google Drive MCP connector’s tool-level permission for “Download file content” is set to “Always allow” in the connector settings page, but Claude Code still shows an interactive approval prompt (“Download File Content requests permission” / “Allow once” / “Deny”) for that tool on subsequent sessions. This happens repeatedly, defeating the purpose of the “Always” setting.

Steps to reproduce:

1. Connect the Google Drive connector.
2. Set the “Download file content” tool permission to “Always allow” in the connector’s permission settings.
3. Use Claude Code across multiple sessions/days, each of which calls download_file_content on the same connector.
4. Observe that the approval prompt reappears in a later session even though the setting still shows “Always.”

Expected behavior: Once a tool’s permission is set to “Always allow,” it should never prompt again for that tool, regardless of session boundaries or connector reconnects.

Actual behavior: The prompt reappears intermittently, seemingly after the connector reconnects.

Suspected cause: The tool’s fully-qualified name appears to change across connector reconnects — e.g. observed as mcp__Google_Drive__download_file_content in one session and mcp__b2e2a2d1-3179-41c5-9d84-0fd831d385ef__download_file_content (a UUID-scoped prefix) in another session, for what is the same underlying Google Drive connector/tool. If the “Always allow” grant is stored keyed to that specific qualified name rather than to the stable tool concept, a reconnect that changes the prefix would silently invalidate the grant — while the settings UI continues to display “Always,” since it’s reading the current instance’s default, not the (now-orphaned) grant tied to the old instance name

<img width="1194" height="580" alt="Image" src="https://github.com/user-attachments/assets/15b3cfa3-5502-42b8-80b9-dfe43bf7033c" />

<img width="1160" height="1316" alt="Image" src="https://github.com/user-attachments/assets/c3c81a41-2c23-42b4-90e3-7d54a28f0054" />

What Should Happen?

Claude should not ask for permission to download Drive files.

Error Messages/Logs

Steps to Reproduce

Steps to reproduce:

1. Connect the Google Drive connector.
2. Set the “Download file content” tool permission to “Always allow” in the connector’s permission settings.
3. Use Claude Code across multiple sessions/days, each of which calls download_file_content on the same connector.
4. Observe that the approval prompt reappears in a later session even though the setting still shows “Always.”

Expected behavior: Once a tool’s permission is set to “Always allow,” it should never prompt again for that tool, regardless of session boundaries or connector reconnects.

Claude Model

Sonnet (default)

Is this a regression?

No, this never worked

Last Working Version

N/A

Claude Code Version

2.1.214

Platform

Anthropic API

Operating System

macOS

Terminal/Shell

Terminal.app (macOS)

Additional Information

_No response_