diff --git a/server/src/http/mcp/diagnostics.rs b/server/src/http/mcp/diagnostics.rs
index f99838bf..0f858f90 100644
--- a/server/src/http/mcp/diagnostics.rs
+++ b/server/src/http/mcp/diagnostics.rs
@@ -148,6 +148,17 @@ pub(super) async fn tool_prompt_permission(
         .to_string();
     let tool_input = args.get("input").cloned().unwrap_or(json!({}));
 
+    // Auto-approve huskies MCP tools — they match the `mcp__huskies__*` entry
+    // in .claude/settings.json, but Claude Code does not honour wildcard
+    // patterns for MCP tool names (only for Bash commands), so we enforce the
+    // same rule here to prevent spurious permission prompts in chat.
+    if tool_name.starts_with("mcp__huskies__") {
+        crate::slog!(
+            "[permission] Auto-approved '{tool_name}' (matches mcp__huskies__* allowlist)"
+        );
+        return Ok(json!({"behavior": "allow", "updatedInput": tool_input}).to_string());
+    }
+
     // Auto-deny immediately if no interactive session is currently listening on
     // perm_rx. Interactive sessions (WebSocket, Matrix bot chat) hold the
     // perm_rx lock for the duration of a chat. If try_lock succeeds, nobody is