rules:
  - capability: mcp
    match: ["nb2lite/*"]
    effect: allow