Claude Code always names MCP tools mcp__<server>__<tool>, so an MCP tool can never collide with a builtin (read_file etc.); its hook matchers and permission rules key on that prefix (bare mcp__lab as a hook matcher matches nothing; mcp__lab__.* is the documented whole-server form, 2.1.195+; plugin-bundled servers become mcp__plugin_<plugin>_<server>__<tool>). v2.1.292 also drops MCP tools whose names exceed the API name-length limit (128 chars) with a per-server warning. yoyo (Day 230) instead SKIPS a whole MCP server if any tool name collides with BUILTIN_TOOL_NAMES (agent_builder.rs pre-flight), so @modelcontextprotocol/server-filesystem is unusable. yoagent 0.25.7 (2026-10-16) fixed McpToolAdapter::with_prefix / from_client_with_prefix to actually emit <prefix>__<tool> (the prefix was stored but unused); the with_mcp_server_* helpers still add no prefix. Open design point for yoyo: prefixing changes tool names that hooks.rs matchers, permissions and audit rows key on, and a prefixed name must stay under the 128-char API limit. Sources: github.com/anthropics/claude-code releases v2.1.292/v2.1.295; yoagent CHANGELOG 0.25.7; theclarity.today on bare MCP hook prefixes.