Claude Code 2.1.299 Tightens MCP Permissions: Allow Rules Now Match Only the Server You Name

Claude Code 2.1.299 makes its MCP permission rules stricter and stops following redirects on several key routes. The release notes read like routine fixes, but they affect anyone who has configured which MCP servers an agent can use.

The biggest change is how allow rules match servers. Before this release, an allow rule like mcp__a could also cover servers named a__b or a_. A rule meant to permit one server could quietly permit others with similar names. Now a rule reaches only the server it names, and a server with a double underscore in its name needs its whole normalized name written out, in the form mcp__<server>__*. The same tightening applies to the tool lists used for agents.

A second fix matters more for anyone relying on deny rules. Deny and ask rules for an MCP server didn’t apply when the server’s normalized name contained a double underscore. A deny rule that silently fails is the opposite of what it’s for. A related fix stops claude mcp list, claude mcp get, and subagent MCP servers from starting a server that a policy check blocks. Blocked servers are now reported as blocked without being launched.

The release also changes how requests are routed. Claude Code no longer follows HTTP redirects on requests to claude.ai’s connector proxy or to Anthropic-hosted MCP servers, and MCP requests in cloud and self-hosted runner sessions no longer follow redirects from the session’s MCP proxy. Redirects issued by a connector’s own server are unaffected.

What the notes don’t say. They don’t explain why the redirect behavior changed, describe any exploitation, or assign a severity or CVE. A third-party summary from Classmethod files the permission changes under security, but that’s its own categorization, not a finding from Anthropic. The notes also don’t say how many setups had rules matching more or less than intended.

For anyone running Claude Code with MCP servers, the practical steps are short: update, review your allow rules, and check that deny and ask rules are taking effect for any server whose name contains a double underscore. If a rule depended on the old, looser matching, it will stop working until it’s rewritten with the full server name.

Bottom line: Version 2.1.299 makes MCP permission rules mean what they say. An allow rule covers only the server it names, and deny rules apply to servers with unusual names. It’s a quiet release note with real consequences for careful configurations, and anything that breaks after updating was probably relying on a rule that matched more than it was supposed to.