Disclosed weakness · no CVE recorded

MCP plugin permissions could miss a differently capitalized name

Anthropic · Claude Code · Plugin MCP permission rules

First documented disclosure · Review checkpoint

Summary

Some deny or ask rules for plugin MCP tools matched names inconsistently across letter case.

Severity and exploitation evidence

No CVSS score recorded in this review.

Exploitation not established: The vendor release notes report a fix and identify no exploitation against users.

Exploitation evidence source

Technical severity is not a measure of observed attacks or of risk to your deployment. Attempts, demonstrations, and successful compromise retain the qualifications in the source.

How the weakness works

Some deny or ask rules for plugin MCP tools matched names inconsistently across letter case.

Conditions required

A session relies on those rules and the MCP server or tool uses different capitalization.

Potential impact

A tool call subject to an approval or deny rule could escape that rule.

Affected versions and configurations

Anthropic did not publish the earliest affected version.

Fix and mitigation status

Anthropic lists the correction in 2.1.325.

Practical next steps

Update Claude Code to a supported release containing the 2.1.325 correction.

Operating lesson

Check that permission rules bind the actual tool identity across all accepted name variants.

Evidence and limits

The November 13 release provides no issue-specific CVE or severity. Its change to the default approval flow for sandboxed Bash is documented separately.

Sources