diff --git a/adapters/claude/config/settings.json b/adapters/claude/config/settings.json
index bd239a4..a177fcb 100644
--- a/adapters/claude/config/settings.json
+++ b/adapters/claude/config/settings.json
@@ -1,9 +1,7 @@
 {
   "permissions": {
     "defaultMode": "auto",
-    "allow": [
-      "Agent"
-    ],
+    "allow": __CLAUDE_ALLOW_RULES__,
     "deny": __CLAUDE_DENY_RULES__
   },
   "sandbox": __CLAUDE_SANDBOX__,
diff --git a/scripts/commands/build.ps1 b/scripts/commands/build.ps1
index e61e4e0..6d67e03 100644
--- a/scripts/commands/build.ps1
+++ b/scripts/commands/build.ps1
@@ -185,9 +185,11 @@ foreach ($shell in @('powershell','bash')) {
             @('Bash(git reset --hard*)','Bash(git clean*)','Bash(rm -rf*)')
         }
         $denyRulesJson = ConvertTo-Json -InputObject $denyRules -Compress
+        $shellTool = if ($shell -eq 'powershell') { 'PowerShell' } else { 'Bash' }
+        $allowRulesJson = ConvertTo-Json -InputObject @('Agent', "$shellTool(mcporter call context7.*)") -Compress
         $compactScript = if ($shell -eq 'powershell') { 'Record-Compact.ps1' } else { 'record-compact.sh' }
         $pointerScript = if ($shell -eq 'powershell') { 'Show-SessionStatePointer.ps1' } else { 'show-session-state-pointer.sh' }
-        $content = $content.Replace('__HOOK_COMMAND__', $command).Replace('__POWERSHELL_HOOK_COMMAND__', $command).Replace('__HOOK_SCRIPT__', $script).Replace('__POWERSHELL_HOOK_SCRIPT__', $script).Replace('__COMPACT_SCRIPT__', $compactScript).Replace('__SESSION_POINTER_SCRIPT__', $pointerScript).Replace('__STATUSLINE_COMMAND__', $command).Replace('__STATUSLINE_SCRIPT__', $statusLineScript).Replace('__CLAUDE_SANDBOX__', $claudeSandbox).Replace('__CLAUDE_DENY_RULES__', $denyRulesJson)
+        $content = $content.Replace('__HOOK_COMMAND__', $command).Replace('__POWERSHELL_HOOK_COMMAND__', $command).Replace('__HOOK_SCRIPT__', $script).Replace('__POWERSHELL_HOOK_SCRIPT__', $script).Replace('__COMPACT_SCRIPT__', $compactScript).Replace('__SESSION_POINTER_SCRIPT__', $pointerScript).Replace('__STATUSLINE_COMMAND__', $command).Replace('__STATUSLINE_SCRIPT__', $statusLineScript).Replace('__CLAUDE_SANDBOX__', $claudeSandbox).Replace('__CLAUDE_DENY_RULES__', $denyRulesJson).Replace('__CLAUDE_ALLOW_RULES__', $allowRulesJson)
         Set-Content -LiteralPath $path -Value $content -Encoding UTF8
     }
 
diff --git a/scripts/commands/build.sh b/scripts/commands/build.sh
index c7472d3..a841373 100644
--- a/scripts/commands/build.sh
+++ b/scripts/commands/build.sh
@@ -174,8 +174,10 @@ for client in codex claude; do
   content=$(<"$path")
   if [ "$shell" = powershell ]; then
     deny_rules='["PowerShell(git reset --hard*)","PowerShell(git clean*)","PowerShell(Remove-Item *-Recurse*)"]'
+    allow_rules='["Agent","PowerShell(mcporter call context7.*)"]'
   else
     deny_rules='["Bash(git reset --hard*)","Bash(git clean*)","Bash(rm -rf*)"]'
+    allow_rules='["Agent","Bash(mcporter call context7.*)"]'
   fi
   content=${content//__HOOK_COMMAND__/$command}
   content=${content//__POWERSHELL_HOOK_COMMAND__/$command}
@@ -187,6 +189,7 @@ for client in codex claude; do
   content=${content//__STATUSLINE_SCRIPT__/$statusline_script}
   content=${content//__CLAUDE_SANDBOX__/$sandbox}
   content=${content//__CLAUDE_DENY_RULES__/$deny_rules}
+  content=${content//__CLAUDE_ALLOW_RULES__/$allow_rules}
   printf '%s\n' "$content" > "$path"
 done