@google/gemini-cli-core 0.33.0-preview.4 → 0.33.0-preview.5

package/dist/src/policy/policy-engine.test.js

@@ -101,19 +101,15 @@ describe('PolicyEngine', () => {
         it('should match unqualified tool names with qualified rules when serverName is provided', async () => {
             const rules = [
                 {
-                    toolName: 'my-server__tool',
+                    toolName: 'mcp_my-server_tool',
+                    mcpName: 'my-server',
                     decision: PolicyDecision.ALLOW,
                 },
             ];
             engine = new PolicyEngine({ rules });
             // Match with qualified name (standard)
-            expect((await engine.check({ name: 'my-server__tool' }, 'my-server')).decision).toBe(PolicyDecision.ALLOW);
-            // Match with unqualified name + serverName (the fix)
-            expect((await engine.check({ name: 'tool' }, 'my-server')).decision).toBe(PolicyDecision.ALLOW);
-            // Should NOT match with unqualified name but NO serverName
-            expect((await engine.check({ name: 'tool' }, undefined)).decision).toBe(PolicyDecision.ASK_USER);
-            // Should NOT match with unqualified name but WRONG serverName
-            expect((await engine.check({ name: 'tool' }, 'wrong-server')).decision).toBe(PolicyDecision.ASK_USER);
+            expect((await engine.check({ name: 'mcp_my-server_tool' }, 'my-server'))
+                .decision).toBe(PolicyDecision.ALLOW);
         });
         it('should match by args pattern', async () => {
             const rules = [
@@ -328,58 +324,45 @@ describe('PolicyEngine', () => {
                 ],
             });
             expect((await engine.check({ name: 'read_file' }, undefined)).decision).toBe(PolicyDecision.ALLOW);
-            expect((await engine.check({ name: 'my-server__tool' }, 'my-server')).decision).toBe(PolicyDecision.ALLOW);
+            expect((await engine.check({ name: 'mcp_my-server_tool' }, 'my-server'))
+                .decision).toBe(PolicyDecision.ALLOW);
         });
-        it('should match any MCP tool when toolName is *__*', async () => {
+        it('should match any MCP tool when toolName is mcp_*', async () => {
             engine = new PolicyEngine({
                 rules: [
-                    { toolName: '*__*', decision: PolicyDecision.ALLOW, priority: 10 },
+                    { toolName: 'mcp_*', decision: PolicyDecision.ALLOW, priority: 10 },
                 ],
                 defaultDecision: PolicyDecision.DENY,
             });
-            expect((await engine.check({ name: 'mcp__tool' }, 'mcp')).decision).toBe(PolicyDecision.ALLOW);
-            expect((await engine.check({ name: 'other__tool' }, 'other')).decision).toBe(PolicyDecision.ALLOW);
+            expect((await engine.check({ name: 'mcp_mcp_tool' }, 'mcp')).decision).toBe(PolicyDecision.ALLOW);
+            expect((await engine.check({ name: 'mcp_other_tool' }, 'other')).decision).toBe(PolicyDecision.ALLOW);
             expect((await engine.check({ name: 'read_file' }, undefined)).decision).toBe(PolicyDecision.DENY);
         });
-        it('should match specific tool across all servers when using *__tool', async () => {
-            engine = new PolicyEngine({
-                rules: [
-                    {
-                        toolName: '*__search',
-                        decision: PolicyDecision.ALLOW,
-                        priority: 10,
-                    },
-                ],
-                defaultDecision: PolicyDecision.DENY,
-            });
-            expect((await engine.check({ name: 'ws__search' }, 'ws')).decision).toBe(PolicyDecision.ALLOW);
-            expect((await engine.check({ name: 'gh__search' }, 'gh')).decision).toBe(PolicyDecision.ALLOW);
-            expect((await engine.check({ name: 'gh__list' }, 'gh')).decision).toBe(PolicyDecision.DENY);
-        });
         it('should match MCP server wildcard patterns', async () => {
             const rules = [
                 {
-                    toolName: 'my-server__*',
+                    toolName: 'mcp_my-server_*',
+                    mcpName: 'my-server',
                     decision: PolicyDecision.ALLOW,
                     priority: 10,
                 },
                 {
-                    toolName: 'blocked-server__*',
+                    toolName: 'mcp_blocked-server_*',
+                    mcpName: 'blocked-server',
                     decision: PolicyDecision.DENY,
                     priority: 20,
                 },
             ];
             engine = new PolicyEngine({ rules });
             // Should match my-server tools
-            expect((await engine.check({ name: 'my-server__tool1' }, 'my-server'))
-                .decision).toBe(PolicyDecision.ALLOW);
-            expect((await engine.check({ name: 'my-server__another_tool' }, 'my-server'))
+            expect((await engine.check({ name: 'mcp_my-server_tool1' }, 'my-server'))
                 .decision).toBe(PolicyDecision.ALLOW);
+            expect((await engine.check({ name: 'mcp_my-server_another_tool' }, 'my-server')).decision).toBe(PolicyDecision.ALLOW);
             // Should match blocked-server tools
-            expect((await engine.check({ name: 'blocked-server__tool1' }, 'blocked-server')).decision).toBe(PolicyDecision.DENY);
-            expect((await engine.check({ name: 'blocked-server__dangerous' }, 'blocked-server')).decision).toBe(PolicyDecision.DENY);
+            expect((await engine.check({ name: 'mcp_blocked-server_tool1' }, 'blocked-server')).decision).toBe(PolicyDecision.DENY);
+            expect((await engine.check({ name: 'mcp_blocked-server_dangerous' }, 'blocked-server')).decision).toBe(PolicyDecision.DENY);
             // Should not match other patterns
-            expect((await engine.check({ name: 'other-server__tool' }, 'other-server'))
+            expect((await engine.check({ name: 'mcp_other-server_tool' }, 'other-server'))
                 .decision).toBe(PolicyDecision.ASK_USER);
             expect((await engine.check({ name: 'my-server-tool' }, undefined)).decision).toBe(PolicyDecision.ASK_USER); // No __ separator
             expect((await engine.check({ name: 'my-server' }, undefined)).decision).toBe(PolicyDecision.ASK_USER); // No tool name
@@ -387,61 +370,65 @@ describe('PolicyEngine', () => {
         it('should prioritize specific tool rules over server wildcards', async () => {
             const rules = [
                 {
-                    toolName: 'my-server__*',
+                    toolName: 'mcp_my-server_*',
+                    mcpName: 'my-server',
                     decision: PolicyDecision.ALLOW,
                     priority: 10,
                 },
                 {
-                    toolName: 'my-server__dangerous-tool',
+                    toolName: 'mcp_my-server_dangerous-tool',
+                    mcpName: 'my-server',
                     decision: PolicyDecision.DENY,
                     priority: 20,
                 },
             ];
             engine = new PolicyEngine({ rules });
             // Specific tool deny should override server allow
-            expect((await engine.check({ name: 'my-server__dangerous-tool' }, 'my-server'))
-                .decision).toBe(PolicyDecision.DENY);
-            expect((await engine.check({ name: 'my-server__safe-tool' }, 'my-server'))
+            expect((await engine.check({ name: 'mcp_my-server_dangerous-tool' }, 'my-server')).decision).toBe(PolicyDecision.DENY);
+            expect((await engine.check({ name: 'mcp_my-server_safe-tool' }, 'my-server'))
                 .decision).toBe(PolicyDecision.ALLOW);
         });
         it('should NOT match spoofed server names when using wildcards', async () => {
-            // Vulnerability: A rule for 'prefix__*' matches 'prefix__suffix__tool'
-            // effectively allowing a server named 'prefix__suffix' to spoof 'prefix'.
+            // Vulnerability: A rule for 'mcp_prefix_*' matches 'mcp_prefix__suffix_tool'
+            // effectively allowing a server named 'mcp_prefix_suffix' to spoof 'prefix'.
             const rules = [
                 {
-                    toolName: 'safe_server__*',
+                    toolName: 'mcp_safe_server_*',
+                    mcpName: 'safe_server',
                     decision: PolicyDecision.ALLOW,
                 },
             ];
             engine = new PolicyEngine({ rules });
-            // A tool from a different server 'safe_server__malicious'
-            const spoofedToolCall = { name: 'safe_server__malicious__tool' };
+            // A tool from a different server 'mcp_safe_server_malicious'
+            const spoofedToolCall = { name: 'mcp_mcp_safe_server_malicious_tool' };
             // CURRENT BEHAVIOR (FIXED): Matches because it starts with 'safe_server__' BUT serverName doesn't match 'safe_server'
             // We expect this to FAIL matching the ALLOW rule, thus falling back to default (ASK_USER)
-            expect((await engine.check(spoofedToolCall, 'safe_server__malicious'))
+            expect((await engine.check(spoofedToolCall, 'mcp_safe_server_malicious'))
                 .decision).toBe(PolicyDecision.ASK_USER);
         });
         it('should verify tool name prefix even if serverName matches', async () => {
             const rules = [
                 {
-                    toolName: 'safe_server__*',
+                    toolName: 'mcp_safe_server_*',
+                    mcpName: 'safe_server',
                     decision: PolicyDecision.ALLOW,
                 },
             ];
             engine = new PolicyEngine({ rules });
             // serverName matches, but tool name does not start with prefix
-            const invalidToolCall = { name: 'other_server__tool' };
+            const invalidToolCall = { name: 'mcp_other_server_tool' };
             expect((await engine.check(invalidToolCall, 'safe_server')).decision).toBe(PolicyDecision.ASK_USER);
         });
         it('should allow when both serverName and tool name prefix match', async () => {
             const rules = [
                 {
-                    toolName: 'safe_server__*',
+                    toolName: 'mcp_safe_server_*',
+                    mcpName: 'safe_server',
                     decision: PolicyDecision.ALLOW,
                 },
             ];
             engine = new PolicyEngine({ rules });
-            const validToolCall = { name: 'safe_server__tool' };
+            const validToolCall = { name: 'mcp_safe_server_tool' };
             expect((await engine.check(validToolCall, 'safe_server')).decision).toBe(PolicyDecision.ALLOW);
         });
     });
@@ -1409,17 +1396,22 @@ describe('PolicyEngine', () => {
         });
         it('should support wildcard patterns for checkers', async () => {
             const rules = [
-                { toolName: 'server__tool', decision: PolicyDecision.ALLOW },
+                {
+                    toolName: 'mcp_server_tool',
+                    mcpName: 'server',
+                    decision: PolicyDecision.ALLOW,
+                },
             ];
             const wildcardChecker = {
                 checker: { type: 'external', name: 'wildcard' },
-                toolName: 'server__*',
+                toolName: 'mcp_server_*',
+                mcpName: 'server',
             };
             engine = new PolicyEngine({ rules, checkers: [wildcardChecker] }, mockCheckerRunner);
             vi.mocked(mockCheckerRunner.runChecker).mockResolvedValue({
                 decision: SafetyCheckDecision.ALLOW,
             });
-            await engine.check({ name: 'server__tool' }, 'server');
+            await engine.check({ name: 'mcp_server_tool' }, 'server');
             expect(mockCheckerRunner.runChecker).toHaveBeenCalledWith(expect.anything(), expect.objectContaining({ name: 'wildcard' }));
         });
         it('should run safety checkers when decision is ASK_USER and downgrade to DENY on failure', async () => {
@@ -1509,11 +1501,13 @@ describe('PolicyEngine', () => {
             {
                 name: 'should return empty set when no rules provided',
                 rules: [],
+                allToolNames: ['tool1'],
                 expected: [],
             },
             {
                 name: 'should apply rules without explicit modes to all modes',
                 rules: [{ toolName: 'tool1', decision: PolicyDecision.DENY }],
+                allToolNames: ['tool1', 'tool2'],
                 expected: ['tool1'],
             },
             {
@@ -1533,6 +1527,7 @@ describe('PolicyEngine', () => {
                         modes: [ApprovalMode.DEFAULT],
                     },
                 ],
+                allToolNames: ['tool1'],
                 expected: [],
             },
             {
@@ -1549,6 +1544,7 @@ describe('PolicyEngine', () => {
                         modes: [ApprovalMode.DEFAULT],
                     },
                 ],
+                allToolNames: ['tool1', 'tool2', 'tool3'],
                 expected: ['tool1'],
             },
             {
@@ -1567,6 +1563,7 @@ describe('PolicyEngine', () => {
                         modes: [ApprovalMode.DEFAULT],
                     },
                 ],
+                allToolNames: ['tool1'],
                 expected: ['tool1'],
             },
             {
@@ -1585,6 +1582,7 @@ describe('PolicyEngine', () => {
                         modes: [ApprovalMode.DEFAULT],
                     },
                 ],
+                allToolNames: ['tool1'],
                 expected: [],
             },
             {
@@ -1597,7 +1595,8 @@ describe('PolicyEngine', () => {
                     },
                 ],
                 nonInteractive: true,
-                expected: [],
+                allToolNames: ['tool1'],
+                expected: ['tool1'],
             },
             {
                 name: 'should ignore rules with argsPattern',
@@ -1609,6 +1608,7 @@ describe('PolicyEngine', () => {
                         modes: [ApprovalMode.DEFAULT],
                     },
                 ],
+                allToolNames: ['tool1'],
                 expected: [],
             },
             {
@@ -1621,6 +1621,7 @@ describe('PolicyEngine', () => {
                     },
                 ],
                 approvalMode: ApprovalMode.PLAN,
+                allToolNames: ['tool1'],
                 expected: ['tool1'],
             },
             {
@@ -1633,6 +1634,7 @@ describe('PolicyEngine', () => {
                     },
                 ],
                 approvalMode: ApprovalMode.DEFAULT,
+                allToolNames: ['tool1'],
                 expected: [],
             },
             {
@@ -1651,36 +1653,55 @@ describe('PolicyEngine', () => {
                     },
                 ],
                 approvalMode: ApprovalMode.YOLO,
+                allToolNames: ['dangerous-tool', 'safe-tool'],
                 expected: [],
             },
             {
                 name: 'should respect server wildcard DENY',
                 rules: [
                     {
-                        toolName: 'server__*',
+                        toolName: 'mcp_server_*',
+                        mcpName: 'server',
                         decision: PolicyDecision.DENY,
                         modes: [ApprovalMode.DEFAULT],
                     },
                 ],
-                expected: ['server__*'],
+                allToolNames: [
+                    'mcp_server_tool1',
+                    'mcp_server_tool2',
+                    'mcp_other_tool',
+                ],
+                metadata: new Map([
+                    ['mcp_server_tool1', { _serverName: 'server' }],
+                    ['mcp_server_tool2', { _serverName: 'server' }],
+                    ['mcp_other_tool', { _serverName: 'other' }],
+                ]),
+                expected: ['mcp_server_tool1', 'mcp_server_tool2'],
             },
             {
                 name: 'should expand server wildcard for specific tools if already processed',
                 rules: [
                     {
-                        toolName: 'server__*',
+                        toolName: 'mcp_server_*',
+                        mcpName: 'server',
                         decision: PolicyDecision.DENY,
                         priority: 100,
                         modes: [ApprovalMode.DEFAULT],
                     },
                     {
-                        toolName: 'server__tool1',
-                        decision: PolicyDecision.DENY,
+                        toolName: 'mcp_server_tool1',
+                        mcpName: 'server',
+                        decision: PolicyDecision.DENY, // redundant but tests ordering
                         priority: 10,
                         modes: [ApprovalMode.DEFAULT],
                     },
                 ],
-                expected: ['server__*', 'server__tool1'],
+                allToolNames: ['mcp_server_tool1', 'mcp_server_tool2'],
+                metadata: new Map([
+                    ['mcp_server_tool1', { _serverName: 'server' }],
+                    ['mcp_server_tool2', { _serverName: 'server' }],
+                ]),
+                expected: ['mcp_server_tool1', 'mcp_server_tool2'],
             },
             {
                 name: 'should exclude run_shell_command but NOT write_file in simulated Plan Mode',
@@ -1707,24 +1728,29 @@ describe('PolicyEngine', () => {
                         priority: 10,
                     },
                 ],
-                expected: ['run_shell_command'],
+                allToolNames: ['write_file', 'run_shell_command', 'read_file'],
+                expected: ['run_shell_command', 'read_file'],
             },
             {
                 name: 'should NOT exclude tool if covered by a higher priority wildcard ALLOW',
                 rules: [
                     {
-                        toolName: 'server__*',
+                        toolName: 'mcp_server_*',
+                        mcpName: 'server',
                         decision: PolicyDecision.ALLOW,
                         priority: 100,
                         modes: [ApprovalMode.DEFAULT],
                     },
                     {
-                        toolName: 'server__tool1',
+                        toolName: 'mcp_server_tool1',
+                        mcpName: 'server',
                         decision: PolicyDecision.DENY,
                         priority: 10,
                         modes: [ApprovalMode.DEFAULT],
                     },
                 ],
+                allToolNames: ['mcp_server_tool1'],
+                metadata: new Map([['mcp_server_tool1', { _serverName: 'server' }]]),
                 expected: [],
             },
             {
@@ -1736,38 +1762,53 @@ describe('PolicyEngine', () => {
                         priority: 10,
                     },
                 ],
-                expected: ['*'],
+                allToolNames: ['toolA', 'toolB', 'mcp_server_toolC'],
+                expected: ['toolA', 'toolB', 'mcp_server_toolC'], // all tools denied by *
             },
             {
                 name: 'should handle MCP category wildcard *__* in getExcludedTools',
                 rules: [
                     {
-                        toolName: '*__*',
+                        toolName: 'mcp_*',
                         decision: PolicyDecision.DENY,
                         priority: 10,
                     },
                 ],
-                expected: ['*__*'],
+                allToolNames: ['localTool', 'mcp_myserver_mytool'],
+                metadata: new Map([
+                    ['mcp_myserver_mytool', { _serverName: 'myserver' }],
+                ]),
+                expected: ['mcp_myserver_mytool'],
             },
             {
-                name: 'should handle tool wildcard *__search in getExcludedTools',
+                name: 'should handle tool wildcard mcp_server_* in getExcludedTools',
                 rules: [
                     {
-                        toolName: '*__search',
+                        toolName: 'mcp_server_*',
                         decision: PolicyDecision.DENY,
                         priority: 10,
                     },
                 ],
-                expected: ['*__search'],
+                allToolNames: [
+                    'localTool',
+                    'mcp_server_search',
+                    'mcp_otherserver_read',
+                ],
+                metadata: new Map([
+                    ['mcp_server_search', { _serverName: 'server' }],
+                    ['mcp_otherserver_read', { _serverName: 'otherserver' }],
+                ]),
+                expected: ['mcp_server_search'],
             },
         ];
-        it.each(testCases)('$name', ({ rules, approvalMode, nonInteractive, expected }) => {
+        it.each(testCases)('$name', ({ rules, approvalMode, nonInteractive, allToolNames, metadata, expected, }) => {
             engine = new PolicyEngine({
                 rules,
                 approvalMode: approvalMode ?? ApprovalMode.DEFAULT,
                 nonInteractive: nonInteractive ?? false,
             });
-            const excluded = engine.getExcludedTools();
+            const toolsSet = allToolNames ? new Set(allToolNames) : undefined;
+            const excluded = engine.getExcludedTools(metadata, toolsSet);
             expect(Array.from(excluded).sort()).toEqual(expected.sort());
         });
         it('should skip annotation-based rules when no metadata is provided', () => {
@@ -1780,7 +1821,7 @@ describe('PolicyEngine', () => {
                     },
                 ],
             });
-            const excluded = engine.getExcludedTools();
+            const excluded = engine.getExcludedTools(undefined, new Set(['dangerous_tool']));
             expect(Array.from(excluded)).toEqual([]);
         });
         it('should exclude tools matching annotation-based DENY rule when metadata is provided', () => {
@@ -1797,7 +1838,7 @@ describe('PolicyEngine', () => {
                 ['dangerous_tool', { destructiveHint: true }],
                 ['safe_tool', { readOnlyHint: true }],
             ]);
-            const excluded = engine.getExcludedTools(metadata);
+            const excluded = engine.getExcludedTools(metadata, new Set(['dangerous_tool', 'safe_tool']));
             expect(Array.from(excluded)).toEqual(['dangerous_tool']);
         });
         it('should NOT exclude tools whose annotations do not match', () => {
@@ -1813,14 +1854,15 @@ describe('PolicyEngine', () => {
             const metadata = new Map([
                 ['safe_tool', { readOnlyHint: true }],
             ]);
-            const excluded = engine.getExcludedTools(metadata);
+            const excluded = engine.getExcludedTools(metadata, new Set(['safe_tool']));
             expect(Array.from(excluded)).toEqual([]);
         });
         it('should exclude tools matching both toolName pattern AND annotations', () => {
             engine = new PolicyEngine({
                 rules: [
                     {
-                        toolName: 'server__*',
+                        toolName: 'mcp_server_*',
+                        mcpName: 'server',
                         toolAnnotations: { destructiveHint: true },
                         decision: PolicyDecision.DENY,
                         priority: 10,
@@ -1828,12 +1870,22 @@ describe('PolicyEngine', () => {
                 ],
             });
             const metadata = new Map([
-                ['server__dangerous_tool', { destructiveHint: true }],
-                ['other__dangerous_tool', { destructiveHint: true }],
-                ['server__safe_tool', { readOnlyHint: true }],
+                [
+                    'mcp_server_dangerous_tool',
+                    { destructiveHint: true, _serverName: 'server' },
+                ],
+                [
+                    'mcp_other_dangerous_tool',
+                    { destructiveHint: true, _serverName: 'other' },
+                ],
+                ['mcp_server_safe_tool', { readOnlyHint: true, _serverName: 'server' }],
             ]);
-            const excluded = engine.getExcludedTools(metadata);
-            expect(Array.from(excluded)).toEqual(['server__dangerous_tool']);
+            const excluded = engine.getExcludedTools(metadata, new Set([
+                'mcp_server_dangerous_tool',
+                'mcp_other_dangerous_tool',
+                'mcp_server_safe_tool',
+            ]));
+            expect(Array.from(excluded)).toEqual(['mcp_server_dangerous_tool']);
         });
         it('should exclude unprocessed tools from allToolNames when global DENY is active', () => {
             engine = new PolicyEngine({
@@ -1849,8 +1901,8 @@ describe('PolicyEngine', () => {
                         priority: 70,
                     },
                     {
-                        // Simulates plan.toml: mcpName="*" → toolName="*__*"
-                        toolName: '*__*',
+                        // Simulates plan.toml: mcpName="*" → toolName="mcp_*"
+                        toolName: 'mcp_*',
                         toolAnnotations: { readOnlyHint: true },
                         decision: PolicyDecision.ASK_USER,
                         priority: 70,
@@ -1861,35 +1913,41 @@ describe('PolicyEngine', () => {
                     },
                 ],
             });
-            // MCP tools are registered with unqualified names in ToolRegistry
+            // MCP tools are registered with qualified names in ToolRegistry
             const allToolNames = new Set([
                 'glob',
                 'read_file',
                 'shell',
                 'web_fetch',
-                'read_mcp_tool',
-                'write_mcp_tool',
+                'mcp_my-server_read_mcp_tool',
+                'mcp_my-server_write_mcp_tool',
             ]);
             // buildToolMetadata() includes _serverName for MCP tools
             const toolMetadata = new Map([
-                ['read_mcp_tool', { readOnlyHint: true, _serverName: 'my-server' }],
-                ['write_mcp_tool', { readOnlyHint: false, _serverName: 'my-server' }],
+                [
+                    'mcp_my-server_read_mcp_tool',
+                    { readOnlyHint: true, _serverName: 'my-server' },
+                ],
+                [
+                    'mcp_my-server_write_mcp_tool',
+                    { readOnlyHint: false, _serverName: 'my-server' },
+                ],
             ]);
             const excluded = engine.getExcludedTools(toolMetadata, allToolNames);
             expect(excluded.has('shell')).toBe(true);
             expect(excluded.has('web_fetch')).toBe(true);
             // Non-read-only MCP tool excluded by catch-all DENY
-            expect(excluded.has('write_mcp_tool')).toBe(true);
+            expect(excluded.has('mcp_my-server_write_mcp_tool')).toBe(true);
             expect(excluded.has('glob')).toBe(false);
             expect(excluded.has('read_file')).toBe(false);
             // Read-only MCP tool allowed by annotation rule
-            expect(excluded.has('read_mcp_tool')).toBe(false);
+            expect(excluded.has('mcp_my-server_read_mcp_tool')).toBe(false);
         });
-        it('should match already-qualified MCP tool names without _serverName', () => {
+        it('should match MCP wildcard rules when explicitly mapped with _serverName', () => {
             engine = new PolicyEngine({
                 rules: [
                     {
-                        toolName: '*__*',
+                        toolName: 'mcp_*',
                         toolAnnotations: { readOnlyHint: true },
                         decision: PolicyDecision.ASK_USER,
                         priority: 70,
@@ -1902,17 +1960,23 @@ describe('PolicyEngine', () => {
             });
             // Tool registered with qualified name (collision case)
             const allToolNames = new Set([
-                'myserver__read_tool',
-                'myserver__write_tool',
+                'mcp_myserver_read_tool',
+                'mcp_myserver_write_tool',
             ]);
             const toolMetadata = new Map([
-                ['myserver__read_tool', { readOnlyHint: true }],
-                ['myserver__write_tool', { readOnlyHint: false }],
+                [
+                    'mcp_myserver_read_tool',
+                    { readOnlyHint: true, _serverName: 'myserver' },
+                ],
+                [
+                    'mcp_myserver_write_tool',
+                    { readOnlyHint: false, _serverName: 'myserver' },
+                ],
             ]);
             const excluded = engine.getExcludedTools(toolMetadata, allToolNames);
-            // Qualified name already contains __, matched directly without _serverName
-            expect(excluded.has('myserver__read_tool')).toBe(false);
-            expect(excluded.has('myserver__write_tool')).toBe(true);
+            // Qualified name matched using explicit _serverName
+            expect(excluded.has('mcp_myserver_read_tool')).toBe(false);
+            expect(excluded.has('mcp_myserver_write_tool')).toBe(true);
         });
         it('should not exclude unprocessed tools when allToolNames is not provided (backward compat)', () => {
             engine = new PolicyEngine({
@@ -2001,7 +2065,7 @@ describe('PolicyEngine', () => {
                         modes: [ApprovalMode.PLAN],
                     },
                     {
-                        toolName: '*__*',
+                        toolName: 'mcp_*',
                         toolAnnotations: { readOnlyHint: true },
                         decision: PolicyDecision.ASK_USER,
                         priority: 70,
@@ -2032,13 +2096,19 @@ describe('PolicyEngine', () => {
                 'write_todos',
                 'memory',
                 'save_memory',
-                'read_tool',
-                'write_tool',
+                'mcp_mcp-server_read_tool',
+                'mcp_mcp-server_write_tool',
             ]);
             // buildToolMetadata() includes _serverName for MCP tools
             const toolMetadata = new Map([
-                ['read_tool', { readOnlyHint: true, _serverName: 'mcp-server' }],
-                ['write_tool', { readOnlyHint: false, _serverName: 'mcp-server' }],
+                [
+                    'mcp_mcp-server_read_tool',
+                    { readOnlyHint: true, _serverName: 'mcp-server' },
+                ],
+                [
+                    'mcp_mcp-server_write_tool',
+                    { readOnlyHint: false, _serverName: 'mcp-server' },
+                ],
             ]);
             const excluded = engine.getExcludedTools(toolMetadata, allToolNames);
             // These should be excluded (caught by catch-all DENY)
@@ -2051,7 +2121,7 @@ describe('PolicyEngine', () => {
             expect(excluded.has('write_file')).toBe(true);
             expect(excluded.has('replace')).toBe(true);
             // Non-read-only MCP tool excluded by catch-all DENY
-            expect(excluded.has('write_tool')).toBe(true);
+            expect(excluded.has('mcp_mcp-server_write_tool')).toBe(true);
             // These should NOT be excluded (explicitly allowed)
             expect(excluded.has('glob')).toBe(false);
             expect(excluded.has('grep_search')).toBe(false);
@@ -2063,7 +2133,7 @@ describe('PolicyEngine', () => {
             expect(excluded.has('exit_plan_mode')).toBe(false);
             expect(excluded.has('save_memory')).toBe(false);
             // Read-only MCP tool allowed by annotation rule (matched via _serverName)
-            expect(excluded.has('read_tool')).toBe(false);
+            expect(excluded.has('mcp_mcp-server_read_tool')).toBe(false);
         });
     });
     describe('YOLO mode with ask_user tool', () => {
@@ -2339,22 +2409,22 @@ describe('PolicyEngine', () => {
             engine = new PolicyEngine({
                 rules: [
                     {
-                        toolName: '*__*',
+                        toolName: 'mcp_*',
                         toolAnnotations: { experimental: true },
                         decision: PolicyDecision.DENY,
                         priority: 20,
                     },
                     {
-                        toolName: '*__*',
+                        toolName: 'mcp_*',
                         decision: PolicyDecision.ALLOW,
                         priority: 10,
                     },
                 ],
             });
-            expect((await engine.check({ name: 'mcp__test' }, 'mcp', {
+            expect((await engine.check({ name: 'mcp_mcp_test' }, 'mcp', {
                 experimental: true,
             })).decision).toBe(PolicyDecision.DENY);
-            expect((await engine.check({ name: 'mcp__stable' }, 'mcp', {
+            expect((await engine.check({ name: 'mcp_mcp_stable' }, 'mcp', {
                 experimental: false,
             })).decision).toBe(PolicyDecision.ALLOW);
         });