The Tool Desk
Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
To auto-approve MCP tools in Claude Code settings, allow them with a server-specific pattern such as mcp__github__*. The pattern mcp__* does not auto-approve all MCP tools: in an allow rule it is unanchored, so Claude Code skips it with a warning. That same broad pattern can be useful in ask or deny rules, where full-name MCP globs are accepted.
How to auto-approve tools from one MCP server
Claude Code names MCP tools using three parts: the literal prefix mcp__, the configured server name, and the tool name, separated by double underscores. A tool from a server named github could therefore have a name such as mcp__github__get_issue. In settings-based permissions, an allow pattern must include the server name literally; a wildcard can match tool names after that server prefix.
![Claude AI for Beginners Bible: [5 in 1] The Ultimate Guide to Automate Your Work, Save Hours Every Week, and Use AI for Real-World Results](https://m.media-amazon.com/images/I/415+fSJacsL._SL160_.jpg)
- Identify the MCP server name as Claude Code has it configured. Use that exact name rather than a display label or a name copied from a different interface.
- Choose whether you want to allow one tool or every tool exposed by that server.
- Add a matching pattern to
permissions.allowin the applicable Claude Code settings file. For all tools from a server namedgithub, usemcp__github__*. For a narrower group, a pattern such asmcp__github__get_*matches that server’s tool names beginning withget_. - Review the other permission rules that could match those calls. A matching
denyoraskrule takes precedence over an allow rule. - Check the installed Claude Code version’s current permission documentation and test the intended behavior before relying on the rule in a security-sensitive setup.
Permission patterns refer to Claude Code’s canonical tool names, not merely the label a server or interface displays. Before choosing a wildcard, compare it with the actual names available in your setup. A pattern ending in get_*, for example, is useful only if the tool names on that server really begin with get_.
Quick wins for a faster PC:
Scan for outdated or missing drivers - takes under a minuteDriver Scan →Clear out junk files and repair common Windows errorsFree Scan →A representative settings fragment is:
{
"permissions": {
"allow": [
"mcp__github__*"
],
"deny": [
"mcp__untrusted__*"
],
"ask": [
"mcp__*"
]
}
}This illustrates the matching syntax, not a universal recommendation to permit every tool on a server. A server-wide allow covers every matching tool that server exposes. Inspect that tool set and grant broad access only when it fits the task and your trust requirements.
#1 Best Overall
What mcp__* means in each permission action
The same-looking pattern does not have the same effect in every action. The key distinction is whether the rule is asking Claude Code to allow, ask about, or deny calls.
| Action in settings | Pattern | Effect |
|---|---|---|
allow |
mcp__* |
Skipped with a warning because the allow pattern does not name a server literally. It does not auto-approve MCP tools. |
allow |
mcp__puppeteer__* |
Matches all tool names from the configured server named puppeteer, subject to higher-priority rules. |
allow |
mcp__github__get_* |
Matches tool names beginning with get_ on the literal github server. |
ask |
mcp__* |
Can match MCP tool names across servers and prompt for matching calls. |
deny |
mcp__* |
Can match MCP tool names across servers and block matching calls. |
In plain language, mcp__* is not a general-purpose “approve all MCP” switch. For an allow rule, Claude Code requires the pattern to be anchored to one server: mcp__<server>__. The wildcard belongs after that prefix, in the tool-name portion. The server segment itself cannot be replaced with a wildcard in a settings allow pattern.
The permissions syntax supports rules written as a tool name or as Tool(specifier). That does not mean every tool accepts parameter-based rules: the settings loader skips MCP rules that use parentheses. In other words, a built-in-tool style rule such as mcp__github__get_issue(owner:example) is not a supported way to allow an MCP call based on its input. Use a full MCP tool name or a supported name glob instead.
Free tools Windows power users keep installed
One-click scans. No signup required.
Choose between allowing a whole server and specific tools
Allow every tool from one named server
Use mcp__server__*, replacing server with the exact configured server name. For example, mcp__puppeteer__* matches all tools from the configured puppeteer server. This is convenient when the whole tool set is appropriate for routine use, but it is broader than approving a single operation. If the server exposes tools with different effects, consider a narrower rule rather than granting them all the same permission.
Allow a subset by tool-name pattern
Use the same literal server prefix, then pattern the tool-name portion. For example, mcp__github__get_* matches names from the github server whose tool-name portion begins with get_. The prefix narrows the server; the remainder narrows the tool names. Confirm that the actual canonical tool names follow the naming pattern you intend to match.
Allow one exact tool
If only one tool should be approved, use its full MCP name, such as mcp__github__get_issue, rather than a wildcard. The exact name must match the tool Claude Code knows; a transcript label or a guessed spelling may not be the canonical name. Exact names minimize the range of tools affected by the allow rule.
The choice is a tradeoff between convenience and scope: an exact name covers one tool; a suffix wildcard can cover a family of tools on one server; and mcp__server__* covers all matching tools on that server. Settings allow rules do not provide an equivalent wildcard for “every server,” because the server name must be literal. If your intent is instead to require confirmation across servers, use the supported ask pattern rather than trying to broaden an allow pattern.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Understand rule precedence before debugging an allow
Claude Code evaluates settings permission rules in this order: deny, then ask, then allow. A matching deny blocks a call even when an allow pattern also matches it. A matching ask prompts even when an allow pattern matches. A narrower allow does not override either higher-priority action.
This ordering means that a valid server-specific allow pattern is not, on its own, proof that a call will proceed without a prompt. Check for broader deny or ask rules as well as the allow rule. For example, with ask: ["mcp__*"] and allow: ["mcp__github__*"], the ask rule still takes precedence for a matching GitHub MCP tool.
There is also a difference between a bare tool-name deny and a scoped glob deny. A bare deny removes the tool from Claude’s context; a scoped glob deny leaves the tool available but blocks calls that match the pattern. Deny and ask rules can be useful for controls spanning multiple MCP servers, while allow patterns deliberately require a named server.
Keep these actions distinct when diagnosing behavior: an allow is meant to approve a match, ask requests confirmation for a match, and deny blocks a match. If a tool is absent or blocked, changing the allow pattern alone may not help; inspect the other matching rules and confirm that the name is one Claude Code recognizes.
Settings permissions are different from --allowedTools
Do not transfer settings wildcard assumptions to the CLI or SDK. The CLI/SDK documentation describes MCP names in the form mcp__<serverName>__<toolName>. It documents allowing exact tool names and says that specifying only mcp__<serverName> allows all tools from that server. It also says glob patterns such as mcp__go* are not supported for the CLI’s --allowedTools flag.
| Configuration surface | Documented way to allow MCP tools | Wildcard caution |
|---|---|---|
Settings-based permissions.allow |
Use a full tool name or an allow glob anchored to a literal server, such as mcp__github__*. |
mcp__* is skipped; do not use it to auto-approve tools. |
CLI/SDK --allowedTools |
Use documented exact tool names or the server-wide form mcp__<serverName>. |
Do not assume settings globs work here; patterns such as mcp__go* are documented as unsupported. |
The CLI reference also describes --allowedTools as additive to settings rules. Because the interaction can depend on the installed version and the way a deployment combines settings with CLI options, verify that behavior for your version before using it as an automated policy control.
So first identify the interface you are configuring. A server-anchored wildcard such as mcp__github__* is a documented settings allow pattern; it should not be copied blindly into --allowedTools. The CLI’s documented server-wide form is different, and its glob limitation applies even though the tool names themselves have a similar structure.
Why an MCP permission rule may not work
The allow pattern uses mcp__*
That is the most direct explanation when the goal is to approve every MCP tool. Settings allow rules cannot use an unanchored wildcard across servers. Replace it with a literal server prefix, such as mcp__github__*, or list exact tool names if approval should be narrower. An unanchored allow glob is skipped with a warning rather than silently granting broad access.
Rank #4
The configured server name is wrong
Allow patterns depend on the server name as Claude Code knows it from configuration. Check the configured name and compare it with the canonical MCP tool name. If a deny or ask rule matches no known tool, Claude Code can issue a startup warning; a misspelled or stale name is a reason to check the names rather than assume a rule is active.
A higher-priority rule still matches
Look for matching deny and ask entries before changing the allow pattern. A broad mcp__* ask rule can continue to prompt for a call that also matches a server-specific allow. A deny match blocks it. Changing an allow to a more specific pattern does not change this precedence.
The rule tries to match MCP parameters
Settings loading skips mcp__ rules written with parentheses, such as a pattern attempting to match tool input parameters. Do not assume MCP tools support the same parameter-matching rules as built-in tools. Use the documented MCP tool-name syntax instead.
A settings pattern was copied to a CLI flag
Settings-based allow globs and the CLI/SDK --allowedTools interface are separate. If a pattern works in settings but not as a CLI flag, use the CLI/SDK’s documented exact-name or server-wide form rather than assuming glob support is shared.
Windows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallOutdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchA deny or ask pattern names no known tool
A broad full-name glob such as mcp__* can be useful for ask or deny, but a rule with a name that matches no known tool may trigger a startup warning. Check the canonical names Claude Code recognizes and the current server configuration. A warning is a cue to verify the intended match, not a reason to assume an ineffective rule is providing the desired control.
Use broad MCP rules deliberately
A rule that covers every tool on a server trades fewer approval prompts for broader authorization. Before applying mcp__server__*, review which tools the server exposes and whether all of them should be allowed without an additional prompt. If the answer differs by tool, prefer exact names or a carefully bounded tool-name pattern. If the desired policy is to request confirmation across MCP servers, an ask rule such as mcp__* is suited to that separate purpose; it is not an allow rule.
Claude Code’s permission documentation is rolling rather than tied here to a specific release. For a security-critical policy or automated deployment, check the current documentation against the exact Claude Code version in use and verify the resulting behavior before rollout.
Frequently Asked Questions
How do I auto-approve MCP tools in Claude Code settings?
Add a settings permissions.allow entry for the configured server, such as mcp__github__* to match all tool names from github. Use an exact tool name or a narrower name glob when you do not want to allow every tool from that server. Check for matching deny and ask rules, which take precedence.
Why doesn’t mcp__* work in the allow list?
Settings allow patterns must begin with a literal mcp__<server>__ prefix. An unanchored allow glob such as mcp__* is skipped with a warning and does not approve tools. It can be used in ask or deny rules to match across MCP servers.
Can I allow all tools from every MCP server with one settings pattern?
Not with a settings allow glob: its server segment must be a literal configured server name. Use a server-specific pattern such as mcp__puppeteer__* for one server, or select exact tool names. A broad mcp__* pattern is available for ask or deny, not allow.
Does mcp__github__* work with --allowedTools?
Do not assume so. Settings-based allow rules and CLI/SDK --allowedTools are separate interfaces. The CLI/SDK documentation describes exact tool names and a server-wide mcp__<serverName> form, and says glob patterns such as mcp__go* are unsupported there.
Can I write an MCP permission rule that only allows a particular input parameter?
Settings loading skips MCP rules that use parentheses, so do not rely on a parameter rule such as mcp__server__tool(param:value). Use the documented MCP tool-name pattern syntax instead.
The Bottom Line
For settings-based auto-approval, anchor the allow pattern to one literal server: mcp__server__* for all its tools, or a narrower tool-name pattern for a subset. mcp__* is not an allow-all shortcut; it is skipped in allow rules, though it can match across servers in ask or deny rules. Check precedence, configured tool names, and the installed version’s current documentation before relying on a permission policy.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
