Claude Code allow rule approves every use of a tool

A bare Bash rule (or mcp__*) approves every shell command or every MCP tool without a prompt, which removes the check against a prompt-injected action. Newer Claude Code versions may reject a bare mcp__* as invalid; either way, name the servers.

client settings checks
5 test fixtures

medium broad-permissions

Flagged

  2     "permissions": {
  3       "allow": [
  4 >       "mcp__*"
  5       ]
  6     }

Fix

Allow only specific commands, e.g. "Bash(npm run test *)", and name MCP servers one by one, e.g. "mcp__puppeteer__*".

Fine

{
  "permissions": {
    "allow": [
      "Bash(npm test:*)",
      "mcp__puppeteer__*",
      "mcp__github"
    ]
  }
}

References

https://code.claude.com/docs/en/permissions

← All rules

Running agents in production?Qlucent assesses agent permissions and data boundaries. →