To auto-approve MCP tools in Claude Code settings, use an allow rule anchored to one configured server, such as mcp__github__*. The broad pattern mcp__* is valid in deny or ask rules, but an allow rule with that pattern is skipped with a warning and approves nothing. These rules apply to settings-based permissions; the CLI and SDK --allowedTools interface has different pattern support.
How to auto-approve tools from one MCP server
In settings-based permissions, an MCP tool name follows the form mcp__<server>__<tool>. For an allow rule, the server portion must be a literal name; a wildcard can match the tool-name portion after it. Add a rule for the server as Claude Code knows it from your configuration:
![Claude AI for Beginners Bible: [5 in 1] The Ultimate Guide to Automate Your Work, Save Hours Every Week, and Use AI for Real-World Results](https://m.media-amazon.com/images/I/415+fSJacsL._SL160_.jpg)
As an Amazon Associate I earn from qualifying purchases.
{
"permissions": {
"allow": [
"mcp__github__*"
]
}
}Here, github is the configured server name. The pattern allows every matching tool exposed by that server. To narrow it to tools whose names begin with get_, use mcp__github__get_*. Replace the example server name with your own.
Do these 3 things before closing this tab:
1Repair Windows errors before they cause bigger problems2Scan for outdated or missing drivers - takes under a minute3Clear out junk files and repair common Windows errorsA server-wide allow rule is broad: it covers every matching tool on that server, not just the tool you happen to call first. Review the server’s exposed tools before granting that access, and check the permissions documentation for the Claude Code version you run if the rule is security-critical.
#1 Best Overall
What mcp__* does in allow, ask, and deny rules
The same-looking pattern does not have the same effect in every action. The permissions documentation allows full-name globs in ask and deny, but restricts allow globs to a literal server prefix.
| Rule action | Example | Effect |
|---|---|---|
allow |
mcp__github__* |
Allows matching tools from the named server, unless a higher-priority matching rule changes the outcome. |
allow |
mcp__* |
Skipped with a warning; it does not auto-approve MCP tools. |
ask |
mcp__* |
Prompts for matching MCP tool calls across servers. |
deny |
mcp__untrusted__* |
Blocks matching calls from the named server. |
deny |
mcp__* |
Matches MCP tools across servers and blocks matching calls. |
For example, this configuration allows tools from one server, blocks a different server, and asks about MCP calls matching the broad ask rule:
Rank #2
{
"permissions": {
"allow": [
"mcp__github__*"
],
"deny": [
"mcp__untrusted__*"
],
"ask": [
"mcp__*"
]
}
}The example illustrates matching, not an endorsement of blanket approval. A matching ask rule still prompts even if an allow rule matches too.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Why a matching allow rule may not auto-approve
Claude Code evaluates permission rules in this order: deny, then ask, then allow. A matching deny blocks the call even when an allow rule also matches. A matching ask prompts even when an allow rule matches. Specificity does not reverse that ordering, so a narrower allow does not override a broader matching deny or ask.
A bare tool-name deny removes the tool from Claude Code’s context. A scoped glob deny leaves the tool available but blocks calls that match the pattern. If a deny or ask rule names no known tool, Claude Code can issue a startup warning; verify the canonical tool name rather than relying on a label shown in a transcript.
Settings permissions are different from --allowedTools
Do not copy settings wildcard rules into the CLI or SDK and assume they behave the same way. In settings-based permissions.allow, a glob such as mcp__github__* is documented for tools from one named server. The CLI and SDK documentation describes --allowedTools separately: it documents exact tool names and a server-wide form using mcp__<serverName>, and says glob patterns such as mcp__go* are unsupported for that flag.
The CLI reference also describes --allowedTools as additive to settings rules. Because these are distinct interfaces, verify the version-specific interaction before relying on it in an automated deployment.
Can MCP permission rules match tool parameters?
Settings loading skips MCP rules written with parentheses, such as a rule intended to match a parameter value in mcp__server__tool(param:value). Use documented MCP tool-name patterns instead; do not assume the parameter-matching syntax available for some built-in tools also applies to MCP rules.
Quick Recap
Official references
- Claude Code permissions documentation covers settings-based rule syntax, pattern limits, precedence, and MCP parameter-rule limitations.
- Claude Code SDK documentation describes MCP tool names and the separate CLI/SDK allowed-tools interface.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
