ToolPermissions

One JSON payload names staging and production. A synthetic first-wins preview shows staging, while Python's default decoder returns production.

Your tool approval says staging. The JSON also says production.

A first-wins preview and a last-wins executor can disagree about the same tool arguments. Both decoded objects can still pass the same schema.

An approved Claude Code MCP call is stopped when a redirect changes the destination, then allowed only after scheme, host, port, TLS identity, and resolved network range match the transport binding

Claude Code approved one MCP server. The request went somewhere else.

An MCP approval can bind to a tool name while DNS, redirects, proxies, and service discovery send the request elsewhere. Pin the transport identity at dispatch time.

A Claude Code call to an MCP method labelled read only fans out into a paid warehouse query, stored export, webhook, and audit-state change before an effect contract gates the call

Claude Code called a read-only MCP tool 186 times. The bill said otherwise.

An MCP method labelled read only can still start paid queries, create exports, send webhooks, and change audit state. Control the effects, not the method name.

A Claude Code MCP permission delta showing one intended staging index allowed while production access, destructive DDL, another database, and role changes remain denied

Test the permission delta before widening Claude Code MCP access

A broader MCP grant may unblock one Claude Code task while authorizing unrelated production actions. Test what became possible and what must remain forbidden.

A Claude Code denial-path eval blocks a plausible production database write because the run has read-only permission

Test the Claude Code tool call that must be refused

A refusal test can pass because the tool is broken. Pair denied calls with permitted controls and adapter faults before trusting an MCP permission gate.

Stop Claude Code before an irreversible tool call

Claude Code can revert a patch, but Git cannot restore every MCP or production effect. Add an irreversibility gate before destructive tool calls run.