Plan Mode re-prompts on every call for parameterized MCP tools, even when covered by a permissions.allow wildcard

Summary

Claude Code's Plan Mode does not consistently honor permissions.allow rules for MCP tool calls, contrary to documented behavior. Zero-argument MCP tools are auto-approved and skip the permission check entirely, but any MCP tool that takes a parameter triggers a bare Yes/No approval prompt on every single call — with no "always allow" / "don't ask again" option — even when an explicit wildcard allow rule covers it.

Environment

• Claude Code version: 2.1.281
• Interface: VS Code extension (observed in a session running concurrently with a CLI session in the same project)
• OS: Windows 11 Enterprise 10.0.26200
• Config scope: project-level .claude/settings.local.json

Config in place

{
  "permissions": {
    "allow": ["mcp__starlims-mcp-server__*", "..."],
    "deny": [],
    "defaultMode": "acceptEdits"
  }
}

Steps to reproduce

1. In a project with an MCP server configured (here: starlims-mcp-server, ~100 tools), add a wildcard allow rule for that server's tools in .claude/settings.local.json, as above.
2. Enter Plan Mode.
3. Call a zero-argument MCP tool, e.g. mcp__starlims-mcp-server__get_table_list.

• Result: runs immediately, no prompt.

1. Call a parameterized MCP tool from the same server, e.g. mcp__starlims-mcp-server__get_starlims_code(uri: "...").

• Result: a permission dialog appears — "Do you want to proceed with mcp__starlims-mcp-server__get_starlims_code?" with only 1 Yes / 2 No options — despite the wildcard allow rule matching this exact tool name.

1. Approve it, then call the same tool again (or a different parameterized tool from the same server, e.g. search_starlims, get_table_relationships, get_table_definition, get_table_sample_data).

• Result: prompted again, every time, for every parameterized call — never remembered, never silenced by the allow rule.

Expected behavior

Per the Plan Mode docs, Plan Mode should apply the same deny → ask → allow rule resolution as normal mode for all tool calls, MCP included. A wildcard allow rule matching the tool name should silence the prompt in Plan Mode exactly as it does outside Plan Mode.

Actual behavior

• Parameter-free MCP tools bypass the check (likely auto-classified as side-effect-free).
• Parameterized MCP tools — read-only or mutating — are gated by what appears to be a separate, stricter per-call approval step specific to Plan Mode, which ignores permissions.allow and never offers a persistent-allow choice.

Impact

Makes Plan Mode unusable for any workflow involving parameterized MCP read tools (code search, schema lookups, etc.) without constant manual approval clicks — even when the user has explicitly configured broad trust for that MCP server.

🤖 Generated with Claude Code