Auto-mode permission classifier denies read-only MCP tools on servers named "production"

Environment: Claude Code desktop app, macOS, defaultMode: "auto".

What happened

I have a Supabase MCP server configured with the --read-only flag, named supabase-fred-production. In auto permission mode the classifier denies every call to it outright - including pure reads like list_tables - with "Blocked by classifier". It never prompts me; it just refuses, so the session hits a wall and I had no idea where the block came from (no deny rule exists anywhere in my settings).

It also blocked the model from invoking the config-editing skill to propose the fix, so diagnosing this took a whole session of detective work.

Why this seems overzealous

• The server is declared --read-only in its own config. The riskiest thing any of its tools can do is a SELECT.
• list_tables on any database is a read. Denying it flat, rather than prompting, turns caution into a dead end.
• The denial message points at adding "a Bash permission rule", which is the wrong hint for an MCP tool.

Suggested behaviour

Prompt instead of hard-deny for MCP reads, or weigh a server's read-only declaration. At minimum, name the tool correctly in the remediation hint.

Workaround that fixed it: explicit allow entries for each mcp__supabase-fred-production__* tool in settings.json.

🤖 Filed with Claude Code at the user's request.