What's Allowed MCP server

whats-allowed-mcp

You wrote a deny rule. Did it do anything? An MCP server that reads every settings file feeding your agent's permissions, shows which one wins, and lists the rules your client accepts and then ignores.

Why

Permission rules for a coding agent are not in one file. They are in up to five at once: a machine-wide managed policy, the project file your team commits, a git-ignored local file, your user file, and whatever a session wrote. They are merged, and then evaluated deny → ask → allow, where the first match wins and specificity does not break the tie.

That merge is hard enough. The part that actually bites is that several rule shapes are accepted and then quietly do nothing:

• Write(docs/**) — file permissions are checked against Edit(path) and Read(path) rules only. A Write, NotebookEdit, MultiEdit or Glob path rule is accepted and never consulted.
• Bash(command:rm *) — a rule can't match a tool's primary content field with the param:value form. It is ignored, because a compound command would bypass it.
• "mcp__*" in allow — an unanchored allow glob is skipped and auto-approves nothing.
• Read(/.env) in user settings — a single leading slash anchors at the settings source, so that rule protects ~/.claude/.env, not the .env in each of your projects.
• Bash(git push origin main) in allow under a Bash(git push *) in deny — a deny rule cannot carry allowlist exceptions, so the allow rule is unreachable.

Claude Code warns about some of these at startup, in a scrollback you have already lost by the time you care. Nothing collects them, nothing tells the agent itself, and nothing shows you the merged picture across all five files at once. This does.

What it looks like

Given a project .claude/settings.json:

{
  "permissions": {
    "deny": ["Bash(git push *)", "Write(.env*)"],
    "allow": [
      "Bash(npm run test:*)",
      "Bash(git push origin main)",
      "Bash(npx *)",
      "Bash(ls*)"
    ]
  }
}

…and a user ~/.claude/settings.json with "deny": ["Read(/.env)"] and "defaultMode": "acceptEdits", whats_allowed returns (paths shortened here):

# Permissions in force

| | |
|---|---|
| Settings files contributing | 2 of 5 possible |
| Permission rules | 3 deny, 0 ask, 4 allow |
| Blanket allow rules (whole tool) | 0 |
| Hook commands wired to agent events | 0 |
| Extra directories granted | 0 |
| Rules that do not do what they look like | 5, of which 1 is ignored outright |

## Default mode

`defaultMode` = **`acceptEdits`**, set in User (`~/.claude/settings.json`).

> Automatically accepts file edits and common filesystem commands (`mkdir`,
> `touch`, `mv`, `cp`) for paths in the working directory or additionalDirectories.

## First things to look at

- **Path rule on Write** — `Write(.env*)` in Project settings
- **Allow rule on a command runner (`npx`)** — `Bash(npx *)` in Project settings
- **Trailing wildcard with no word boundary** — `Bash(ls*)` in Project settings

Seven rules. Five of them do something other than what they read as — and the one everybody would have bet on, Write(.env*), is never consulted at all.

Tools

Shortened. The full README is on GitHub.