You want one allow rule to cover MCP tools across every server you have configured, so you try a wildcard in the server position. What is the outcome?

Easyclaude-codemcppermissionsrules

Last reviewed 21 Aug 2026

The session refuses to start, since an unanchored allow pattern is treated as a configuration error.
It does not work, because an allow rule's server segment has to name one configured server.Correct answer
It works, because allow rules and deny rules accept exactly the same patterns as each other.
It works and covers everything, because a wildcard in that position is the intended shorthand.

Show answer & explanation

Correct answer: B. It does not work, because an allow rule's server segment has to name one configured server.

Explanation

The principle — Allowing and denying are not mirror images. A rule that is too broad in a deny list costs you convenience; the same rule in an allow list costs you the protection.

Why the key is correct — For allow rules the server segment must be glob-free so the rule names a specific server you configured. A pattern that does not is skipped rather than honoured.

Why the others are wrong — The wildcard is not shorthand, it is the thing being prevented. The session starts normally and the rule is simply not applied. And the two lists deliberately do not accept the same patterns.

Remember this — You may wildcard the tool, never the server.

Sources — Anthropic's Claude Code permissions reference.

Sources

Primary sourceConfigure permissions — Anthropic · accessed 20 Aug 2026
“The server segment must be glob-free so the rule names a specific server you configured.”

Practise 10 questions on this topic

Take MCP Integration in Claude Code — Timed Test 1 (10 questions) — scored instantly, explanation for every question, no login.

Start the test

You want one allow rule to cover MCP tools across every server you have configured, so you try a wildcard in the server position. What is the outcome?

Related questions

You want one allow rule to cover MCP tools across every server you have configured, so you try a wildcard in the server position. What is the outcome?

Related questions