MCP permission audit
See which MCP tools write, delete, run commands or reach the network — server annotations kept apart from guesses — with explicit permission rules.
What it does
Paste a server's tools/list result and, if you have it, your MCP client's configuration. The audit shows, for each tool, what the server claims it does and what its name suggests — two separate columns — which rule of the client decides it, and a starting point of explicit rules: allow what is read-only, ask for everything else.
This is about your MCP client and the servers it connects to. It is not Salyro's MCP Expose, where a gateway is the server, or MCP Connect, where a gateway is the client.
Try it: a file server with Claude Code settings, or tools with no annotations.
What it reads
The same tool lists as the tool-description linter: a tools/list result, its JSON-RPC response, or a request's tools array.
What the server claims
MCP's annotations: readOnlyHint, destructiveHint, idempotentHint and openWorldHint. Where a server says nothing, the specification's defaults apply — not read-only, destructive, open world — which is the least a client can assume. The specification calls them hints that "are not guaranteed to provide a faithful description of tool behavior", and says clients should never make tool-use decisions based on annotations from untrusted servers. This page does not verify them: they are the server's words.
What the name suggests
A heuristic, and labelled as one. Words in the tool's name (delete_file, sendEmail, run-query) and in its parameters' names (url, command, to) suggest that it deletes, writes, runs commands or reaches the network. When the server claims read-only and the name suggests otherwise, that is a warning to check which is true.
Claude Code rules
A Claude Code settings file's permissions are read as its permissions page says: mcp__<server> and mcp__<server>__* match every tool of a server, mcp__<server>__<tool> one tool; rules are evaluated deny, then ask, then allow; an allow glob works only after a literal mcp__<server>__ prefix, so mcp__* in allow does nothing; and an mcp__ rule with parentheses is skipped. A deny or ask glob in the tool-name position — "*", "mcp__*" — matches the full tool name, so deny: ["*"] denies every MCP tool whatever allow says.
- A rule that approves a whole server approves every tool it adds later, without a new decision. An explicit list never widens by itself — the principle Salyro's MCP Connect follows for the tools a Behavior may use.
- A tool that runs without a prompt and changes things, by the server's claim or by its name, is a warning.
The configuration
An mcpServers map names the servers, so the tools can be matched to one. A stdio server is a program on your machine that runs with your user's access: its annotations describe its tools, they do not limit the program.
The suggestion
Allowed without a prompt: only tools the server claims are read-only and whose name suggests nothing else. Every other tool asks. Each is named one by one. It is a starting point, not a verdict — check each tool yourself.
What it does not know
- What a tool really does. It reads names and claims; it runs nothing and connects to nothing.
- Other clients' rules: only Claude Code's permissions page was read.
- Your permission mode, managed settings or hooks, which also decide whether a call prompts.
Sources
Annotation defaults and their status as hints are the MCP specification's schema, and the rule syntax is Claude Code's permissions page on code.claude.com, both recorded as Reference Data with the date they were read.
Where the numbers come from
- Facts about models and providers that are not in that catalogue carry their own source and the date they were checked, and are shown as unknown where no reliable source exists.