cc-safe-setup 29.7.0 → 30.0.4

package/examples/mcp-config-poisoning-audit.sh

@@ -0,0 +1,150 @@
+#!/bin/bash
+# ================================================================
+# mcp-config-poisoning-audit.sh — Read-only audit for supply-chain
+#   poisoning of your Claude Code config (NOT prevention of Claude's
+#   own edits — that's hook-tamper-guard / mcp-config-freeze)
+# ================================================================
+# PURPOSE:
+#   A malicious npm package's post-install script, or a malicious MCP
+#   server, can rewrite ~/.claude.json / ~/.claude/settings.json
+#   *outside* Claude Code entirely — so no PreToolUse hook ever fires.
+#   Two reported shapes (June 2026 wave + Mitiga Labs / CVE-2025-59536):
+#     - An injected hook (e.g. SessionStart) whose command calls out to
+#       the network or evals a payload, to exfiltrate keys on next open.
+#     - An mcpServers entry whose endpoint is rewritten to a localhost
+#       proxy or an unfamiliar external host, so authenticated MCP
+#       traffic (and OAuth tokens) is routed through attacker infra.
+#   The existing guards PREVENT Claude from editing config and FREEZE
+#   mid-session additions, but nothing AUDITS config that was already
+#   poisoned from outside. This fills that gap.
+#
+# HOW IT WORKS: SessionStart hook. Read-only. Scans the config files,
+#   flags hook commands containing network/eval indicators and
+#   mcpServers entries pointing at external/localhost-proxy endpoints,
+#   and prints a warning. It never edits or deletes anything (some of
+#   these payloads retaliate by wiping the home dir if tampered with —
+#   so this only reports; you review and remediate by hand).
+#   Always exits 0 (advisory; never blocks the session).
+#
+# See: CVE-2025-59536 (RCE via malicious hooks in repo settings),
+#      CVE-2026-21852 (key exfil via env override), and the Mitiga
+#      Labs ~/.claude.json MCP-routing-rewrite disclosure.
+#
+# TRIGGER: SessionStart
+# MATCHER: "" (SessionStart has no matcher)
+#
+# Configuration:
+#   CC_MCP_AUDIT_OFF=1            — disable
+#   CC_MCP_AUDIT_TRUSTED_HOSTS    — colon-separated host substrings to
+#                                   treat as expected (e.g. "githubcopilot.com:api.githubcopilot")
+# ================================================================
+
+set -uo pipefail
+
+[ "${CC_MCP_AUDIT_OFF:-0}" = "1" ] && exit 0
+command -v jq >/dev/null 2>&1 || exit 0   # fail open: no jq, no audit
+
+HOME_DIR="${HOME:-/root}"
+CANDIDATES=(
+    "$HOME_DIR/.claude.json"
+    "$HOME_DIR/.claude/settings.json"
+    "$HOME_DIR/.claude/settings.local.json"
+    ".claude/settings.json"
+    ".claude/settings.local.json"
+    ".mcp.json"
+)
+
+# Network / code-exec indicators that almost never belong in a legit
+# hook command. Kept conservative to avoid noise.
+NET_EXEC_RE='curl |wget |\bnc \b|netcat|/dev/tcp/|node +-e|node +--eval|python3? +-c|deno +eval|base64 +-d|base64 +--decode|\beval +"|\beval +\$|bash +-i|sh +-i|powershell +-enc|Invoke-WebRequest|iwr '
+
+TRUSTED="${CC_MCP_AUDIT_TRUSTED_HOSTS:-}"
+
+findings=0
+note() { echo "  ⚠ $*" >&2; findings=$((findings + 1)); }
+
+is_trusted() {
+    # $1 = string to test; returns 0 if it contains a trusted substring
+    [ -n "$TRUSTED" ] || return 1
+    local IFS=':' t
+    for t in $TRUSTED; do
+        [ -n "$t" ] && case "$1" in *"$t"*) return 0;; esac
+    done
+    return 1
+}
+
+audit_file() {
+    local f="$1"
+    [ -f "$f" ] || return 0
+    jq -e . "$f" >/dev/null 2>&1 || return 0   # invalid JSON: other guards handle it
+
+    # 1) Hook commands (any event) containing network/exec indicators.
+    #    .hooks is { Event: [ { hooks: [ { command } ] } ] }
+    local cmds
+    cmds=$(jq -r '
+        (.hooks // {}) | to_entries[] | .key as $ev
+        | (.value // []) | .[]? | (.hooks // []) | .[]?
+        | select(.command != null) | "\($ev)\t\(.command)"
+    ' "$f" 2>/dev/null)
+    if [ -n "$cmds" ]; then
+        while IFS=$'\t' read -r ev cmd; do
+            [ -z "$cmd" ] && continue
+            if printf '%s' "$cmd" | grep -qiE "$NET_EXEC_RE"; then
+                is_trusted "$cmd" && continue
+                note "[$f] hook '$ev' runs a network/exec command: ${cmd:0:90}"
+            fi
+        done <<< "$cmds"
+    fi
+
+    # 2) mcpServers endpoints: external URLs / IP literals / localhost proxies.
+    #    Entry may carry a "url" (http transport) or "command"+"args" (stdio).
+    # Use the unit separator (0x1f) — empty fields must NOT collapse, and
+    # tab is IFS-whitespace so consecutive tabs around an empty url would
+    # merge and shift every field.
+    local servers
+    servers=$(jq -r '
+        (.mcpServers // .mcp_servers // {}) | to_entries[]
+        | "\(.key)\((.value.url // ""))\((.value.command // ""))\(((.value.args // []) | join(" ")))"
+    ' "$f" 2>/dev/null)
+    if [ -n "$servers" ]; then
+        while IFS=$'\x1f' read -r name url cmd args; do
+            [ -z "$name" ] && continue
+            local blob="$url $cmd $args"
+            is_trusted "$blob" && continue
+            # external http(s) endpoint
+            if printf '%s' "$url" | grep -qiE '^https?://'; then
+                case "$url" in
+                    http://127.0.0.1*|http://localhost*|http://[::1]*)
+                        note "[$f] MCP server '$name' routes through a localhost proxy: $url" ;;
+                    *)
+                        note "[$f] MCP server '$name' uses an external HTTP endpoint: $url" ;;
+                esac
+            fi
+            # raw IP literal or pipe-to-shell hidden in command/args
+            if printf '%s' "$cmd $args" | grep -qiE "$NET_EXEC_RE"; then
+                note "[$f] MCP server '$name' command contains a network/exec indicator: ${cmd} ${args}"
+            fi
+        done <<< "$servers"
+    fi
+}
+
+for f in "${CANDIDATES[@]}"; do
+    audit_file "$f"
+done
+
+if [ "$findings" -gt 0 ]; then
+    {
+        echo ""
+        echo "⚠ cc-safe-setup: possible Claude Code config poisoning ($findings finding(s) above)."
+        echo "  A malicious npm post-install or MCP server can rewrite ~/.claude.json /"
+        echo "  settings.json from outside Claude, so no PreToolUse hook catches it."
+        echo "  This is a READ-ONLY warning — verify each item by hand. Do NOT blindly delete"
+        echo "  (some payloads retaliate). If any is unexpected:"
+        echo "    1) update Claude Code (CVE-2025-59536 / CVE-2026-21852 are patched in current builds)"
+        echo "    2) rotate the OAuth tokens / API keys reachable from that config"
+        echo "    3) remove the injected hook/server entry by hand and review recent npm installs"
+        echo "  Silence expected entries with CC_MCP_AUDIT_TRUSTED_HOSTS, or CC_MCP_AUDIT_OFF=1."
+    } >&2
+fi
+
+exit 0

package/examples/mcp-data-boundary.sh

@@ -34,7 +34,7 @@ if echo "$OUTPUT" | grep -qiE "$SENSITIVE_PATHS"; then
 fi
 
 # Check for data that looks like secrets in output
-if echo "$OUTPUT" | grep -qE 'sk-[a-zA-Z0-9]{20,}|ghp_[a-zA-Z0-9]{30,}|-----BEGIN.*KEY|AKIA[A-Z0-9]{16}'; then
+if echo "$OUTPUT" | grep -qE '(^|[^A-Za-z0-9])sk-[A-Za-z0-9_-]{20,}|ghp_[a-zA-Z0-9]{30,}|-----BEGIN.*KEY|AKIA[A-Z0-9]{16}'; then
     echo "⚠ MCP DATA BOUNDARY: MCP tool output contains potential secrets" >&2
     echo "  Tool: $TOOL" >&2
     echo "  Review output for leaked credentials." >&2

package/examples/mcp-misdiagnosis-arrest.sh

@@ -0,0 +1,209 @@
+#!/bin/bash
+# mcp-misdiagnosis-arrest.sh — Catch the assistant misdiagnosing a silently-
+# dropped MCP connector as "the connector isn't installed", and surface the
+# actual recovery path before the operator wastes a reinstall round-trip.
+#
+# Solves: #60428 ("Slack MCP tools silently deactivate mid-session ~1h
+# uptime; claude mcp list still reports Connected").
+#
+# In that case, an installed MCP connector (Slack, in the reported instance)
+# silently drops out of the model's deferred-tool registry after ~1 hour of
+# uptime. The model then attempts a tool call, gets a missing-tool result,
+# and — guided by current docs/skill prompts — frequently suggests the
+# operator "install the Connector" as the remediation. The reporter
+# documents this as the secondary issue:
+#
+#   "That's wrong: the Connector *is* already installed, it was working in
+#    this session, and the suggestion sends users on a 30-second wild goose
+#    chase before they realize the real fix is restart / new chat /
+#    plugin toggle."
+#
+# The actual recovery path the reporter verified (2026-05-19):
+#
+#   1. Open a new chat in the same Claude Code window (re-binds tools in the
+#      original session without losing context).
+#   2. Toggle the Connector's Plugin off → on in Customize → Personal plugins.
+#   3. Restart Claude Code (loses session).
+#   4. /clear (nukes context — not a real fix).
+#
+# What does NOT restore the tools: /mcp, /compact, /resume, /config, waiting.
+#
+# This hook runs on Stop, scans the assistant's most recent turn for
+# misdiagnosis patterns ("you need to install the X Connector", "the X
+# Plugin isn't installed", "the MCP server seems missing"), cross-references
+# against ~/.claude/settings.json to confirm the named connector IS
+# installed, and — if so — emits an advisory with the correct recovery path.
+#
+# Advisory-default (exit 0 + stderr). Strict mode (exit 2) is opt-in via
+# CC_MCP_MISDIAGNOSIS_MODE=strict.
+#
+# Related Issues:
+#   #60428 — Slack MCP tools silently deactivate (the primary)
+#
+# TRIGGER: Stop
+# MATCHER: ""
+#
+# CONFIGURATION (environment variables):
+#   CC_MCP_MISDIAGNOSIS_MODE       "strict" → exit 2 when misdiagnosis is
+#                                  detected against an installed connector.
+#                                  Default: advisory (exit 0).
+#   CC_MCP_MISDIAGNOSIS_DISABLE    "1" → skip the gate entirely.
+#   CC_MCP_SETTINGS_PATH           Override the settings.json path used to
+#                                  confirm connector installation. Default:
+#                                  ~/.claude/settings.json. Tests use this
+#                                  to point at a fixture file.
+#
+# USAGE (settings.json):
+#   {
+#     "hooks": {
+#       "Stop": [{
+#         "matcher": "",
+#         "hooks": [{
+#           "type": "command",
+#           "command": "~/.claude/hooks/mcp-misdiagnosis-arrest.sh"
+#         }]
+#       }]
+#     }
+#   }
+
+set -uo pipefail
+
+# Without jq, the parse below silently yields empty and this hook stops
+# guarding - with no error anywhere. Say so. We deliberately do not exit
+# here: blocking would halt every tool call, and exiting 0 would change
+# the behaviour of guards that do not depend on the parsed value.
+if ! command -v jq >/dev/null 2>&1; then
+  _nojq_warned="/tmp/cc-nojq-warned-mcp-misdiagnosis-arrest-$PPID"
+  [ -f "$_nojq_warned" ] || {
+    echo "WARNING [mcp-misdiagnosis-arrest]: jq not found - this hook cannot inspect tool calls and is NOT protecting you. Install jq." >&2
+    : > "$_nojq_warned"
+  }
+fi
+
+[ "${CC_MCP_MISDIAGNOSIS_DISABLE:-0}" = "1" ] && exit 0
+
+INPUT=$(cat 2>/dev/null || true)
+[ -z "$INPUT" ] && exit 0
+
+SETTINGS_PATH="${CC_MCP_SETTINGS_PATH:-$HOME/.claude/settings.json}"
+
+# Extract the assistant's last message text. Stop-hook input shape varies
+# across Claude Code versions; try several keys (matching the precedent set
+# in closure-word-verify-gate.sh).
+ASSISTANT_TEXT=$(printf '%s' "$INPUT" | jq -r '
+    .transcript[-1].content //
+    .last_assistant_message //
+    .stop_input.assistant_text //
+    .assistant_message //
+    empty
+' 2>/dev/null)
+
+[ -z "$ASSISTANT_TEXT" ] && exit 0
+
+# Misdiagnosis patterns. The shape we want to catch is:
+#   "<thing> Connector/Plugin/MCP server isn't installed / needs to be
+#    installed / is missing / not configured"
+# We intentionally over-match a little; the false-positive cost is a
+# stderr advisory, the false-negative cost is the operator on a reinstall
+# wild goose chase.
+MISDIAG_PATTERN='(([Cc]onnector|[Pp]lugin|[Mm]CP[[:space:]]+[Ss]erver)[[:space:]]+(isn'\''t|is[[:space:]]+not|needs[[:space:]]+to[[:space:]]+be|appears[[:space:]]+to[[:space:]]+be|seems[[:space:]]+to[[:space:]]+be|is)[[:space:]]+(installed|configured|missing|unavailable|set[[:space:]]+up)|need[[:space:]]+to[[:space:]]+install[[:space:]]+the[[:space:]]+[A-Za-z][A-Za-z0-9_-]*[[:space:]]+(Connector|Plugin)|install[[:space:]]+the[[:space:]]+[A-Za-z][A-Za-z0-9_-]*[[:space:]]+(Connector|Plugin)[[:space:]]+(first|to[[:space:]]+use|before)|[Mm]CP[[:space:]]+(tool|tools)[[:space:]]+(are|aren'\''t|is|isn'\''t)[[:space:]]+(missing|unavailable|registered|available))'
+
+if ! printf '%s' "$ASSISTANT_TEXT" | grep -Eq "$MISDIAG_PATTERN"; then
+    exit 0
+fi
+
+# Misdiagnosis language matched. Now check: is any MCP connector / plugin
+# actually installed? If yes, the misdiagnosis is wrong and we should warn.
+# If no installed connectors, the assistant's "isn't installed" claim might
+# be correct — stay silent rather than false-positive.
+
+if [ ! -r "$SETTINGS_PATH" ]; then
+    # No readable settings to confirm against — refuse to false-positive.
+    exit 0
+fi
+
+# Look for any of:
+#   * an enabledPlugins entry like "slack@claude-plugins-official": true
+#   * an mcpServers entry (any key under .mcpServers)
+#   * a plugins block with any entry
+INSTALLED_CONNECTORS=$(jq -r '
+    [
+      (.enabledPlugins // {} | to_entries | map(select(.value == true) | .key)),
+      (.mcpServers // {} | keys),
+      (.plugins // {} | keys)
+    ] | add | unique | .[]
+' "$SETTINGS_PATH" 2>/dev/null)
+
+if [ -z "$INSTALLED_CONNECTORS" ]; then
+    # Nothing installed → assistant's "isn't installed" may be correct.
+    exit 0
+fi
+
+# Try to extract the specific connector name the assistant referenced, so
+# we can match it against the installed set (most precise warning). If we
+# cannot extract a name, we still warn — any installed connector means the
+# generic "you need to install one" advice is at least partly wrong.
+NAMED_CONNECTOR=$(printf '%s' "$ASSISTANT_TEXT" \
+    | grep -Eio '(install[[:space:]]+the[[:space:]]+)?[A-Za-z][A-Za-z0-9_-]*[[:space:]]+(Connector|Plugin|MCP[[:space:]]+Server)' \
+    | head -1 \
+    | sed -E 's/^install[[:space:]]+the[[:space:]]+//I; s/[[:space:]]+(Connector|Plugin|MCP[[:space:]]+Server)$//I')
+
+NAMED_MATCH=""
+if [ -n "$NAMED_CONNECTOR" ]; then
+    # Case-insensitive substring match against installed connector keys.
+    NAMED_LOWER=$(printf '%s' "$NAMED_CONNECTOR" | tr '[:upper:]' '[:lower:]')
+    while IFS= read -r installed; do
+        installed_lower=$(printf '%s' "$installed" | tr '[:upper:]' '[:lower:]')
+        if printf '%s' "$installed_lower" | grep -Fq "$NAMED_LOWER"; then
+            NAMED_MATCH="$installed"
+            break
+        fi
+    done <<EOF
+$INSTALLED_CONNECTORS
+EOF
+fi
+
+# Build advisory.
+{
+    echo "<system-reminder>"
+    echo "MCP MISDIAGNOSIS LIKELY — the assistant's last turn suggested an MCP"
+    echo "connector/plugin needs to be installed, but the operator's settings"
+    echo "already show installed MCP connectors:"
+    echo ""
+    printf '%s\n' "$INSTALLED_CONNECTORS" | sed 's/^/  - /'
+    echo ""
+    if [ -n "$NAMED_MATCH" ]; then
+        echo "Specifically, '$NAMED_MATCH' is already installed and configured."
+    elif [ -n "$NAMED_CONNECTOR" ]; then
+        echo "The named connector '$NAMED_CONNECTOR' was not found in settings,"
+        echo "but other connectors are installed — double-check the name before"
+        echo "recommending a reinstall."
+    fi
+    echo ""
+    echo "Known pattern (#60428): MCP connectors can silently drop out of the"
+    echo "session's deferred-tool registry after ~1h uptime while 'claude mcp"
+    echo "list' continues to report 'Connected'. The model then misdiagnoses"
+    echo "this as missing installation."
+    echo ""
+    echo "Actual recovery path (verified 2026-05-19):"
+    echo "  1. Open a new chat in the same Claude Code window."
+    echo "     (Re-binds tools in the original session without losing context.)"
+    echo "  2. Toggle the connector's Plugin off → on in Customize → Personal"
+    echo "     plugins."
+    echo "  3. Restart Claude Code (loses session)."
+    echo ""
+    echo "What does NOT restore them: /mcp, /compact, /resume, /config, waiting,"
+    echo "or reinstalling the connector."
+    echo ""
+    echo "Before sending the assistant's last turn to the operator, replace the"
+    echo "installation advice with the recovery steps above."
+    echo ""
+    echo "To disable this gate (for genuinely uninstalled-connector flows),"
+    echo "set CC_MCP_MISDIAGNOSIS_DISABLE=1 in your environment."
+    echo "</system-reminder>"
+} >&2
+
+if [ "${CC_MCP_MISDIAGNOSIS_MODE:-advisory}" = "strict" ]; then
+    exit 2
+fi
+exit 0

package/examples/mcp-orphan-leak-warner.sh

@@ -0,0 +1,49 @@
+#!/bin/bash
+# mcp-orphan-leak-warner.sh — At session start, warn if leaked MCP / sub-agent
+#   server processes from earlier sessions are still alive and piling up, before
+#   they exhaust RAM/swap into an OOM / kernel panic.
+#
+# Solves a recurring May–June 2026 class (anthropics/claude-code #64366, #68647,
+# #66020, #68933, #61748, …): MCP servers and sub-agent children outlive the
+# session that spawned them — reparented to PID 1 — and accumulate until the box
+# swaps to death or kernel-panics. This is *process/memory* exhaustion, distinct
+# from MCP token/context bloat. The actionable moment is the start of your NEXT
+# session, before you spawn more.
+#
+# Precision: ADVISORY ONLY. This hook never kills anything. Being reparented to
+# PID 1 is not sufficient to call a process an orphan (legitimate daemons are
+# PID-1-parented too), so it flags a process ONLY when it is BOTH (a) reparented
+# to PID 1 AND (b) matches an MCP/agent-server command signature, and even then
+# it only *reports*. You decide what to reap. It also stays silent unless the
+# leak is real (>= MIN_COUNT orphans), to avoid nagging.
+#
+# TRIGGER: SessionStart
+
+MIN_COUNT=${CC_MCP_ORPHAN_MIN_COUNT:-3}   # warn only at/above this many orphans
+MIN_AGE=${CC_MCP_ORPHAN_MIN_AGE:-300}     # seconds; ignore freshly-started servers
+
+# MCP / agent-server signatures: how Claude Code spawns MCP servers (npx/uvx
+# launchers, @modelcontextprotocol packages, *mcp-server* binaries). Tuned to
+# avoid matching editors, shells, or your own long-running daemons.
+SIG='@modelcontextprotocol|mcp-server-|modelcontextprotocol|[/ ]mcp([ _-]|$)|uvx[^|]*mcp|npx[^|]*mcp'
+
+read -r COUNT TOTAL_KB < <(ps -eo ppid=,etimes=,rss=,args= 2>/dev/null \
+  | awk -v sig="$SIG" -v minage="$MIN_AGE" '
+      $1==1 && $2>=minage {
+        args=""; for(i=4;i<=NF;i++) args=args (i>4?" ":"") $i
+        if (args ~ sig) { c++; kb+=$3 }
+      }
+      END { print c+0, kb+0 }')
+
+[ "${COUNT:-0}" -lt "$MIN_COUNT" ] && exit 0
+
+{
+  echo "NOTE: $COUNT leaked MCP / sub-agent server process(es) from earlier sessions"
+  echo "are still alive (~$((TOTAL_KB/1024)) MB resident, reparented to PID 1). Left to"
+  echo "pile up these can exhaust RAM/swap into an OOM or kernel panic (#64366, #68647)."
+  echo "Review them:    ps -o pid,etimes,rss,args -p \$(pgrep -f 'mcp-server-|@modelcontextprotocol')"
+  echo "Reap safely:    kill the ones you recognize as dead-session leftovers."
+  echo "Prevent a panic: cap memory for heavy sessions:  ( ulimit -v 8000000; claude )"
+} >&2
+
+exit 0

package/examples/mcp-permissions-ask-warner.sh

@@ -0,0 +1,151 @@
+#!/bin/bash
+# mcp-permissions-ask-warner.sh — Warn when permissions.ask has MCP entries
+#
+# Solves: github.com/anthropics/claude-code/issues/58289
+#         "permissions.ask is ignored for MCP tools in default mode"
+#
+#         Reporter (2026-05-13, Claude Code 2.1.139 + Bedrock): MCP tool
+#         entries in the `permissions.ask` array of `~/.claude/settings.json`
+#         do not trigger a confirmation prompt. The MCP tool call executes
+#         immediately, the same as if the entry were in `allow`. The user's
+#         intent ("ask before running this MCP tool") diverges from the
+#         system's behavior ("run without asking") with no visible signal.
+#
+# WHY THIS MATTERS:
+#   permissions.ask is the gating mechanism users rely on to keep a human
+#   in the loop for sensitive MCP tools (database writes, deployment, file
+#   delete, payment). If this gating is silently bypassed, sensitive MCP
+#   tools fire without the user's review. This is a textbook claim-verify
+#   gap: the user believes "this is gated" while the system has already
+#   run the tool. Worse, the MCP surface is where many irreversible
+#   operations live (cloud resource changes, payment processing, message
+#   sending).
+#
+# TRIGGER: SessionStart  MATCHER: ""
+#
+# HOW IT WORKS:
+#   At session start:
+#     1. Find the relevant settings.json files.
+#        Default order: ~/.claude/settings.json, then $CLAUDE_PROJECT_DIR/.claude/settings.json
+#     2. For each file, parse the permissions.ask array.
+#     3. Filter entries to MCP tools (starting with "mcp__").
+#     4. If any MCP entries are found, emit a clear warning listing them,
+#        explaining the known bypass, and suggesting two workarounds:
+#          (a) Move sensitive MCP entries from permissions.ask to permissions.deny
+#              (deny still works correctly per the reporter)
+#          (b) Use `--permission-mode plan` mode for the session if MCP-heavy
+#
+# CONFIGURATION:
+#   CC_MCP_ASK_DISABLE=1     — disable the hook entirely
+#   CC_MCP_ASK_ACTION        — "warn" (default) or "block" (exit 2)
+#   CC_MCP_ASK_LOG           — log file path (default /tmp/cc-mcp-ask.log)
+#   CC_MCP_ASK_FILES         — comma-separated settings.json paths to scan
+#                              (default: $HOME/.claude/settings.json plus
+#                              $CLAUDE_PROJECT_DIR/.claude/settings.json)
+#
+# Usage:
+# {
+#   "hooks": {
+#     "SessionStart": [{
+#       "hooks": [{ "type": "command", "command": "~/.claude/hooks/mcp-permissions-ask-warner.sh" }]
+#     }]
+#   }
+# }
+
+if [ "${CC_MCP_ASK_DISABLE:-0}" = "1" ]; then
+  exit 0
+fi
+
+# Without jq, the parse below silently yields empty and this hook stops
+# guarding - with no error anywhere. Say so. We deliberately do not exit
+# here: blocking would halt every tool call, and exiting 0 would change
+# the behaviour of guards that do not depend on the parsed value.
+if ! command -v jq >/dev/null 2>&1; then
+  _nojq_warned="/tmp/cc-nojq-warned-mcp-permissions-ask-warner-$PPID"
+  [ -f "$_nojq_warned" ] || {
+    echo "WARNING [mcp-permissions-ask-warner]: jq not found - this hook cannot read your settings files and is NOT protecting you. Install jq." >&2
+    : > "$_nojq_warned"
+  }
+fi
+
+ACTION="${CC_MCP_ASK_ACTION:-warn}"
+LOG_FILE="${CC_MCP_ASK_LOG:-/tmp/cc-mcp-ask.log}"
+
+# Determine which settings.json files to scan
+if [ -n "$CC_MCP_ASK_FILES" ]; then
+  IFS=',' read -ra FILES <<< "$CC_MCP_ASK_FILES"
+else
+  FILES=()
+  [ -f "$HOME/.claude/settings.json" ] && FILES+=("$HOME/.claude/settings.json")
+  if [ -n "$CLAUDE_PROJECT_DIR" ] && [ -f "$CLAUDE_PROJECT_DIR/.claude/settings.json" ]; then
+    FILES+=("$CLAUDE_PROJECT_DIR/.claude/settings.json")
+  fi
+fi
+
+# Collect MCP entries across all files
+MCP_ENTRIES=()
+SOURCE_FILES=()
+
+for f in "${FILES[@]}"; do
+  f=$(echo "$f" | xargs)  # trim
+  [ -z "$f" ] && continue
+  [ ! -f "$f" ] && continue
+  # Extract permissions.ask entries that look like MCP tools
+  ENTRIES=$(jq -r '
+    (.permissions.ask // [])
+    | map(select(type == "string" and startswith("mcp__")))
+    | .[]
+  ' "$f" 2>/dev/null)
+  if [ -n "$ENTRIES" ]; then
+    while IFS= read -r entry; do
+      [ -z "$entry" ] && continue
+      MCP_ENTRIES+=("$entry")
+      SOURCE_FILES+=("$f")
+    done <<< "$ENTRIES"
+  fi
+done
+
+# No MCP ask entries → silent pass
+if [ ${#MCP_ENTRIES[@]} -eq 0 ]; then
+  exit 0
+fi
+
+# Log + emit
+TIMESTAMP=$(date '+%Y-%m-%d %H:%M:%S')
+for i in "${!MCP_ENTRIES[@]}"; do
+  echo "[$TIMESTAMP] mcp_in_ask entry=${MCP_ENTRIES[$i]} source=${SOURCE_FILES[$i]} action=$ACTION" >> "$LOG_FILE"
+done
+
+MSG="⚠️  permissions.ask contains MCP tool entries that may be silently bypassed"
+MSG+=$'\n'
+MSG+=$'\n'"  Affected entries:"
+for i in "${!MCP_ENTRIES[@]}"; do
+  MSG+=$'\n'"    - ${MCP_ENTRIES[$i]}  (in ${SOURCE_FILES[$i]})"
+done
+MSG+=$'\n'
+MSG+=$'\n'"  Known bug: github.com/anthropics/claude-code/issues/58289"
+MSG+=$'\n'"  In Claude Code 2.1.139 (and possibly other versions), permissions.ask"
+MSG+=$'\n'"  entries for MCP tools (names starting with mcp__) do not trigger a"
+MSG+=$'\n'"  confirmation prompt in default mode. The tool executes immediately,"
+MSG+=$'\n'"  as if it were in permissions.allow. Reported on Bedrock (us.anthropic."
+MSG+=$'\n'"  claude-opus-4-7), likely also affects other providers."
+MSG+=$'\n'
+MSG+=$'\n'"  Workarounds (pick one):"
+MSG+=$'\n'"    1. Move the listed entries from permissions.ask to permissions.deny."
+MSG+=$'\n'"       deny still gates correctly per the bug report. The tool will be"
+MSG+=$'\n'"       refused outright; you can override case-by-case in the chat."
+MSG+=$'\n'"    2. Run the session with --permission-mode plan, which forces an"
+MSG+=$'\n'"       explicit plan-approval step before any tool execution."
+MSG+=$'\n'"    3. Remove the entry from permissions.ask if the tool is acceptable"
+MSG+=$'\n'"       to run without confirmation."
+MSG+=$'\n'
+MSG+=$'\n'"  This warning fires once per session start. To silence it after you've"
+MSG+=$'\n'"  adopted a workaround, set CC_MCP_ASK_DISABLE=1 in your environment."
+
+if [ "$ACTION" = "block" ]; then
+  printf '%s\n' "$MSG" >&2
+  exit 2
+else
+  printf '%s\n' "$MSG" >&2
+  exit 0
+fi