Toolpermissions

An approved Claude Code MCP call is stopped when a redirect changes the destination, then allowed only after scheme, host, port, TLS identity, and resolved network range match the transport binding

Claude Code approved one MCP server. The request went somewhere else.

An MCP approval can bind to a tool name while DNS, redirects, proxies, and service discovery send the request elsewhere. Pin the transport identity at dispatch time.

A Claude Code call to an MCP method labelled read only fans out into a paid warehouse query, stored export, webhook, and audit-state change before an effect contract gates the call

Claude Code called a read-only MCP tool 186 times. The bill said otherwise.

An MCP method labelled read only can still start paid queries, create exports, send webhooks, and change audit state. Control the effects, not the method name.

A Claude Code MCP permission delta showing one intended staging index allowed while production access, destructive DDL, another database, and role changes remain denied

Test the permission delta before widening Claude Code MCP access

A broader MCP grant may unblock one Claude Code task while authorizing unrelated production actions. Test what became possible and what must remain forbidden.

A Claude Code denial-path eval blocks a plausible production database write because the run has read-only permission

Test the Claude Code tool call that must be refused

Happy-path evals show whether Claude Code can use a tool. A denial-path fixture proves whether it refuses a plausible request that exceeds its approved authority.

Stop Claude Code before an irreversible tool call

Claude Code can revert a patch, but Git cannot restore every MCP or production effect. Add an irreversibility gate before destructive tool calls run.