diff --git a/packages/kilo-docs/pages/automate/mcp/using-in-cli.md b/packages/kilo-docs/pages/automate/mcp/using-in-cli.md
index b39f2de56c..d2b2d1be8f 100644
--- a/packages/kilo-docs/pages/automate/mcp/using-in-cli.md
+++ b/packages/kilo-docs/pages/automate/mcp/using-in-cli.md
@@ -161,9 +161,9 @@ Add the test MCP server for development:
 
 ## Tool Permissions
 
-MCP tools use the same permission system as built-in tools (`allow`, `ask`, `deny`). Each MCP tool's permission key is its namespaced name: `{server}_{tool}` (e.g. `my_server_do_something`). You can use glob patterns like `my_server_*` for broad rules.
+MCP tools use the same permission system as built-in tools (`allow`, `ask`, `deny`). Each MCP tool's permission key is its namespaced name: `{server}_{tool}` (e.g. `github_create_pull_request`). You can use glob patterns like `github_*` for broad rules.
 
-For full details on configuring MCP tool permissions — including examples with glob patterns and per-tool overrides — see [Auto-Approving Actions](/docs/getting-started/settings/auto-approving-actions#mcp-tool-permissions).
+For full details on configuring auto-approval permissions — see [Auto-Approving Actions](/docs/getting-started/settings/auto-approving-actions).
 
 ## Environment Variables
 
diff --git a/packages/kilo-docs/pages/automate/mcp/using-in-kilo-code.md b/packages/kilo-docs/pages/automate/mcp/using-in-kilo-code.md
index c367179619..901b20e5e8 100644
--- a/packages/kilo-docs/pages/automate/mcp/using-in-kilo-code.md
+++ b/packages/kilo-docs/pages/automate/mcp/using-in-kilo-code.md
@@ -424,11 +424,35 @@ To set the maximum time to wait for a response after a tool call to the MCP serv
 
 ### Tool Permissions
 
-MCP tools use the same permission system as built-in tools (`allow`, `ask`, `deny`). Each MCP tool's permission key is its namespaced name: `{server}_{tool}` (e.g. `my_server_do_something`). You can use glob patterns like `my_server_*` for broad rules.
+MCP tools use the same permission system as built-in tools (`allow`, `ask`, `deny`). Each MCP tool's permission key is its namespaced name: `{server}_{tool}` (e.g. `github_create_pull_request`). You can use glob patterns like `github_*` for broad rules.
 
-For full details on configuring MCP tool permissions — including examples with glob patterns and per-tool overrides — see [Auto-Approving Actions](/docs/getting-started/settings/auto-approving-actions#mcp-tool-permissions).
+For full details on configuring auto-approval permissions — see [Auto-Approving Actions](/docs/getting-started/settings/auto-approving-actions).
 
 {% tabs %}
+{% tab label="VSCode" %}
+
+**At runtime:** When an MCP tool is called and no permission rule matches, the Permission Dock shows an approval prompt (equivalent to `"ask"`). Click **Approve Always** to save an `"allow"` rule to your config so future calls to that tool are auto-approved.
+
+**In your config file:** Add the tool name (or a wildcard pattern) to the `permission` key in `kilo.jsonc`:
+
+```jsonc
+{
+  "permission": {
+    // Require approval for all tools on this server by default
+    "github_*": "ask",
+
+    // Auto-approve a specific safe tool
+    "github_get_file_contents": "allow",
+
+    // Block a dangerous tool entirely
+    "github_delete_file": "deny",
+  },
+}
+```
+
+Rules are evaluated top-to-bottom and the **last** matching rule wins. Put broad patterns first, then add specific overrides after them.
+
+{% /tab %}
 {% tab label="VSCode (Legacy)" %}
 
 In the legacy extension, MCP tool auto-approval works on a per-tool basis and is disabled by default. To configure auto-approval:
diff --git a/packages/kilo-docs/pages/getting-started/settings/auto-approving-actions.md b/packages/kilo-docs/pages/getting-started/settings/auto-approving-actions.md
index 741a996fed..e9452c33a2 100644
--- a/packages/kilo-docs/pages/getting-started/settings/auto-approving-actions.md
+++ b/packages/kilo-docs/pages/getting-started/settings/auto-approving-actions.md
@@ -75,19 +75,19 @@ MCP tools use the same permission system as built-in tools. Each MCP tool's perm
 ```jsonc
 {
   "permission": {
-    // Auto-approve a specific tool
-    "my_server_safe_read": "allow",
+    // Require approval for all tools on this server by default
+    "github_*": "ask",
 
-    // Require approval for all other tools on this server
-    "my_server_*": "ask",
+    // Auto-approve a specific safe tool
+    "github_get_file_contents": "allow",
 
     // Block a dangerous tool entirely
-    "my_server_delete_all": "deny",
+    "github_delete_file": "deny",
   },
 }
 ```
 
-Glob patterns are evaluated top-to-bottom and the first match wins, so you can allow specific safe tools while requiring approval for everything else on a server.
+Rules are evaluated top-to-bottom and the **last** matching rule wins. Put broad patterns first, then add specific overrides after them.
 
 ## Defaults
 
@@ -242,19 +242,19 @@ Add the tool name (or a wildcard pattern) to the `permission` key in your `kilo.
 ```jsonc
 {
   "permission": {
-    // Auto-approve a specific tool
-    "my_server_safe_read": "allow",
+    // Require approval for all tools on this server by default
+    "github_*": "ask",
 
-    // Require approval for all other tools on this server
-    "my_server_*": "ask",
+    // Auto-approve a specific safe tool
+    "github_get_file_contents": "allow",
 
     // Block a dangerous tool entirely
-    "my_server_delete_all": "deny",
+    "github_delete_file": "deny",
   },
 }
 ```
 
-Glob patterns are evaluated top-to-bottom and the first match wins. This lets you allow specific safe tools while requiring approval for everything else on a server.
+Rules are evaluated top-to-bottom and the **last** matching rule wins. Put broad patterns first, then add specific overrides after them.
 
 ## Full Configuration Example