Claude Code MCP permissions: allow one fetch tool, not every tool

A fetch server is a tool you call many times a session, and each call can stop for an approval prompt. Allow rules let Claude Code use a tool without manual approval, so the fix is one line in a settings file. The catch is the exact form of that line: a rule that looks right can match nothing.

Checked against the Claude Code permissions docs, the Cursor MCP docs and the Codex docs as of this post's date.

Write the tool's full name

mcp__<server>__<tool> is the name of one MCP tool. <server> is the name you gave the server when you added it, and <tool> is the name the server registers.

1. Note the name you gave the server when you added it.
2. Look up the tool name the server registers. The reference mcp-server-fetch exposes one tool, fetch. Added as fetch, its full name is mcp__fetch__fetch.
3. Add the full name to permissions.allow.

{
  "permissions": {
    "allow": ["mcp__fetch__fetch"]
  }
}

mcp__fetch__* matches every tool of that server. So does the bare mcp__fetch. Use the per-tool form when the server also has tools you want to approve one call at a time.

Mind the characters in the server name

my.server becomes my_server in tool names, because dots and spaces turn into _. Write the rule the way the tool name reads, so a server configured as my.server needs mcp__my_server__*.

mcp__plugin_<plugin>_<server>__* is the form for a server that a plugin provides. A server whose name contains __ or ends in _ needs the wildcard form with the whole name, for example mcp__reports__v2__*, because the shorter forms are read as rules for a server named reports.

Do not add parentheses

mcp__fetch__fetch(url:example.com) looks like a way to allow only some URLs. It is not. Claude Code skips any mcp__ rule with parentheses when it loads a settings file. It reports the skipped rule in the invalid-settings dialog at the start of an interactive session and in claude doctor output.

--disallowedTools is the documented route for a deny rule that matches a parameter on an MCP tool. Allow rules for MCP tools take no specifier at all.

Pick the right settings file

~/.claude/settings.json holds your user settings, and its rules apply in every project. That is the natural home for a fetch server you use everywhere.

.claude/settings.json in the repository shares the rule with the team. Its allow rules apply only after each person accepts the workspace trust dialog for that folder, and the dialog lists the rules first. Deny and ask rules there are not held back by trust, because they only restrict.

/permissions opens a dialog that lists every rule and the settings file it comes from. You can open it while Claude is working; a rule you add or remove applies from Claude's next tool call.

Know what overrides an allow rule

Rules are evaluated deny first, then ask, then allow. The first match decides, and a more specific rule does not change that order.

• An ask rule for mcp__fetch__* still prompts, even with mcp__fetch__fetch in allow.
• A deny at any settings level cannot be allowed at another level. A user-level deny blocks a project-level allow, and the reverse.
• If your organization set a claude.ai connector tool to ask, and that setting reaches your session, allow rules for that tool do not take effect. Those connector tools appear as mcp__claude_ai_<server>__<tool>.

An allowed fetch tool runs on whatever URL the model passes it, without asking you. Allow it where that is what you want.

The same goal in Cursor and Codex

Cursor asks for approval before using MCP tools by default. MCP follows the same Run Modes as terminal commands: in Auto-review mode, allowlisted MCP tools run immediately and the rest go through the classifier. On a team, admins set tool allowlists in Team Settings > MCP Configuration; an empty allowlist allows all tools from that server. To turn a whole server off, use its toggle under Customize in the sidebar.

Codex sets this per server in config.toml. enabled_tools is an allow list of the tool names the server exposes, and disabled_tools is a deny list applied after it.

[mcp_servers.fetch]
# keep the command or url lines you already have
enabled_tools = ["fetch"]

default_tools_approval_mode and the per-tool tools.<tool>.approval_mode take auto, prompt, writes or approve. The Codex docs define writes, which prompts for tools that are not marked read-only; check the reference for your version before you rely on the others. The rest of a remote entry is in the Codex config.toml guide.

Try it with a real server

FetchMCP API runs a remote fetch server. The MCP server registers 2 tools: get_page_contents reads one public URL per call, and get_account_status reports credits left, plan and rate limit. Added under the name fetchmcp, the allow rules are:

{
  "permissions": {
    "allow": [
      "mcp__fetchmcp__get_page_contents",
      "mcp__fetchmcp__get_account_status"
    ]
  }
}

The connection itself is in the remote server setup guide, and the current server URL is in the MCP docs.