Skip to content

TOOL_APPROVAL.md

Latest commit

 

History

History
160 lines (115 loc) · 4.2 KB

TOOL_APPROVAL.md

File metadata and controls

160 lines (115 loc) · 4.2 KB

Tool Approval Guide

Why Tool Approval is Needed

Claude Code requires explicit approval before MCP tools can be used. This is a security feature to prevent unauthorized code execution.

Methods to Approve Tools

Method 1: Interactive Approval (During Use)

When Claude tries to use a semcode tool for the first time, you'll see:

Do you want to proceed?
❯ 1. Yes
  2. Yes, and don't ask again for plugin:semcode:semcode - find_function commands in /home/clm/local/linux
  3. No, and tell Claude what to do differently (esc)

Choose option 2 to approve that tool permanently for that directory.

You'll need to do this once per tool (13 times total) unless you pre-approve.

Method 2: Pre-approve During Installation

When running the install script, you'll be prompted:

./plugin/semcode/install.sh

# When prompted:
Would you like to pre-approve semcode tools for a specific directory?
Enter directory path: /home/clm/local/linux

This will automatically approve all 13 tools for that directory.

Method 3: Pre-approve After Installation

Use the standalone approval script:

cd /home/clm/local/src/semcode
./plugin/semcode/approve-tools.sh /home/clm/local/linux

This approves all 13 semcode tools for the specified directory.

Method 4: Manual Approval (Advanced)

Edit ~/.claude.json directly:

# Backup first
cp ~/.claude.json ~/.claude.json.backup

# Edit the file
vim ~/.claude.json

Find the project section and add tools to allowedTools:

{
  "projects": {
    "/home/clm/local/linux": {
      "allowedTools": [
        "mcp__semcode__find_function",
        "mcp__semcode__find_type",
        "mcp__semcode__find_callers",
        "mcp__semcode__find_calls",
        "mcp__semcode__find_callchain",
        "mcp__semcode__diff_functions",
        "mcp__semcode__grep_functions",
        "mcp__semcode__vgrep_functions",
        "mcp__semcode__find_commit",
        "mcp__semcode__vcommit_similar_commits",
        "mcp__semcode__lore_search",
        "mcp__semcode__dig",
        "mcp__semcode__vlore_similar_emails"
      ],
      ...
    }
  }
}

Complete Tool List

These are all 13 semcode tools that need approval:

  1. mcp__semcode__find_function - Find functions/macros
  2. mcp__semcode__find_type - Find types/structs
  3. mcp__semcode__find_callers - Find callers
  4. mcp__semcode__find_calls - Find callees
  5. mcp__semcode__find_callchain - Build call chains
  6. mcp__semcode__diff_functions - Extract from diffs
  7. mcp__semcode__grep_functions - Regex search
  8. mcp__semcode__vgrep_functions - Semantic search
  9. mcp__semcode__find_commit - Find commits
  10. mcp__semcode__vcommit_similar_commits - Semantic commit search
  11. mcp__semcode__lore_search - Search email archives
  12. mcp__semcode__dig - Find emails for commit
  13. mcp__semcode__vlore_similar_emails - Semantic email search

Per-Directory Approval

Tool approvals are per-directory. If you approve tools for /home/clm/local/linux, you'll need to approve them again for /home/clm/local/another-project.

To approve for multiple directories:

./plugin/semcode/approve-tools.sh /home/clm/local/linux
./plugin/semcode/approve-tools.sh /home/clm/local/btrfs
./plugin/semcode/approve-tools.sh /home/clm/projects/myproject

Verifying Approval

Check your current approvals:

cat ~/.claude.json | jq '.projects["/home/clm/local/linux"].allowedTools'

Should show all 13 tools.

Troubleshooting

Issue: Tools still asking for approval after pre-approval

Solution: Restart Claude Code. Changes to ~/.claude.json only take effect after restart.

Issue: jq: command not found

Solution: Install jq:

sudo apt-get install jq

Issue: Accidentally broke ~/.claude.json

Solution: Restore from backup:

cp ~/.claude.json.backup ~/.claude.json

Security Implications

Approving tools allows Claude to:

  • Read your codebase database
  • Execute semcode-mcp binary
  • Search code, commits, and emails

This is read-only access to your indexed data. Semcode cannot:

  • Modify your source code
  • Execute arbitrary commands
  • Access files outside the database

Pre-approving is safe for directories you trust and have already indexed.