Is it required to use claude_args with --allowedTools when these permissions are already in settings.json? #1037

The settings.json permissions.allow field and --allowedTools serve different purposes in the action context. settings.json permissions apply to the Claude Code session globally, but when the action runs, it creates a restricted sandbox where MCP tools need explicit allowlisting through --allowedTools in claude_args.

The reason your inline review comment MCP tool only works with --allowedTools is that MCP tool permissions are evaluated separately from built-in tool permissions. The settings file handles built-in tools (Read, Write, Bash, etc.) but MCP tools added by the action (like the GitHub PR review tools) need to be explicitly allowed via the CLI flag.

This is expected behavior, not a bug. The pattern you want is:

claude_args: '--allowedTools "mcp__github__create_review_comment" "mcp__github__list_review_comments"'

You can find the exact MCP tool names by checking the action logs where it lists registered MCP tools at startup.

Yes, for MCP tools that can still be required.

From the current action docs:

• repo .mcp.json tools can be auto-detected, but they still need to be explicitly allowed,
• the action’s default MCP tools also still need explicit allowlisting via claude_args,
• and claude_args takes precedence over settings.

So if your inline review comment MCP tool only works when you pass --allowedTools mcp__github_inline_comment__create_inline_comment, that matches the documented behavior.

My rule of thumb would be:

• keep broad session config in settings.json,
• keep workflow-specific MCP allowlisting in claude_args.

yes, for MCP tools you still need --allowedTools in claude_args. they cover different scopes: settings.json permissions.allow controls built-in tools (Read/Write/Bash/Edit), while action-injected MCP tools (e.g. mcp__github_inline_comment__create_inline_comment) are registered dynamically at runtime and aren't covered by the settings permission model. claude_args also takes precedence over settings. so --allowedTools mcp__... in claude_args is the expected pattern, not a workaround. exact MCP tool names appear in the run logs at startup.