@whyshouldaicareone AI disaster a day, and the fix

Make every MCP tool ask before it acts

Claude got mail access and drafted a message to an ex. This guide sets which MCP tools run alone and which always ask.

The fix

An MCP tool is named mcp__server__tool, and mcp__server__* matches every tool of one server. Put that in ask and every call to that server prompts you, even if an allow rule also matches. Put the tools you never want in deny. Rules are checked deny, then ask, then allow, and the first match wins. The names below are examples: use your own from /mcp.

copy and paste

{
  "permissions": {
    "ask": ["mcp__mail__*"],
    "deny": ["mcp__mail__create_draft"]
  }
}

Check it worked

In /mcp, select a tool to see its full name. /permissions lists every rule and the settings file it comes from. Then ask Claude to use the tool. An ask rule shows a prompt even when an allow rule also matches.

copy and paste

/mcp
/permissions
claude mcp list

Let the safe tools through

If prompts for read-only tools wear you down, do not allow the whole server. Name the read tools in allow and the write tools in ask. An allow glob must start with a literal mcp__server__ prefix. An ask rule on the same tool still wins.

copy and paste

{
  "permissions": {
    "allow": ["mcp__github__get_*"],
    "ask": ["mcp__mail__send_message"]
  }
}

Pro tip: pick the scope when you add a server

local (the default) is you, this project. project writes .mcp.json, shared through git. user is you, all projects. Claude Code asks you to approve project servers from .mcp.json; claude mcp reset-project-choices resets those answers. Non-interactive claude -p runs load them without asking.

copy and paste

claude mcp add --transport http mail \
  https://example.com/mcp --scope local

claude mcp reset-project-choices

Pro tip: switch a server off

To keep a server configured but unused, toggle it off in /mcp. Do not use bypassPermissions mode with plugged-in tools: it skips permission prompts.

Common mistake

Allowing a whole server: mcp__mail or mcp__mail__* in allow. That pre-approves its send tool too. Allow named read tools only, and keep write tools on ask. Do not put parentheses in an mcp__ rule: Claude Code skips it.

Official docs

One fix of twenty: the whole Claude Code survival kit.

Follow @whyshouldaicare

A new disaster and its fix every day. Comment the word under a reel to get its guide.