You declined the approval prompt for a project server once and want to be certain it never loads for you again, in scripted runs as well as interactive ones. What actually achieves that?

The principle — Declining a prompt answers a question. It does not create a rule, and a question that is never asked cannot be declined.

Why the key is correct — A deny entry in any settings file still rejects the server. Because the rejection is a setting rather than an answer, it applies to sessions that never show a prompt, which is exactly the case that a declined prompt leaves uncovered.

Why the others are wrong — A declined prompt governs only the session types that ask, and headless runs load project servers without asking. Deleting the shared entry works but takes the server away from everyone. And one deny entry suffices; it does not need repeating per scope.

Remember this — Refusing once is an answer to a question. Denying is a rule, and only the rule reaches the sessions that never ask the question in the first place.

Sources — Anthropic's Claude Code MCP reference.