To keep an MCP tool call from changing production data without review, pause the call before execution, show a person the specific tool and arguments, and resume only if they explicitly approve that call. Keep authentication, authorization, input validation, and the final permission check in the MCP server: a confirmation prompt, tool annotation, or model instruction is not a security boundary.
What an MCP approval gate should do
An approval gate is a human decision point between a proposed tool call and its execution. The reviewer needs enough detail to understand the target, action, and arguments—not merely a generic “Allow?” prompt. The approval should be associated with the individual pending call, not treated as blanket permission for later calls.
As an Amazon Associate I earn from qualifying purchases.
In OpenAI’s Responses API flow, a call that needs review produces an mcp_approval_request. The application reviews the requested tool and its arguments, then sends an mcp_approval_response to approve or reject it. The documented approval applies to one tool call.
Free tools Windows power users keep installed
One-click scans. No signup required.
Decide which actions need a person’s approval
Inventory effects, not just tool names
List the tools exposed by the server and record what each can do using the credentials available to it. A tool named “update” might have broad access; a tool named “lookup” could still expose sensitive records. Classify the actual effects and targets, including actions that:
#1 Best Overall
- POWERFUL SECURITY KEY: The Security Key C NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key C NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key C NFC via USB-C and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
- create, update, or delete production records;
- send messages or publish information outside the system;
- deploy code, change permissions, or alter configuration; or
- read or disclose sensitive data.
For each action, consider its impact and how easily it can be reversed. Set the approval policy accordingly. A read that exposes private information may merit stricter controls than a harmless status check, even though it does not modify state.
Use annotations as descriptions, not enforcement
OpenAI’s MCP server guidance says to mark a tool’s readOnlyHint true only when it cannot change state, and to use destructiveHint for actions with irreversible or difficult-to-reverse outcomes. These annotations help clients understand the tool, but they do not authorize a caller or force a confirmation. Make the descriptions match the tool’s real behavior and enforce the policy elsewhere.
Rank #2
- POWERFUL SECURITY KEY: The YubiKey 5C NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5C NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5C NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
Choose the approval mechanism supported by your runtime
The documented controls differ by product and execution path. Do not assume one client’s configuration or approval flow applies to every MCP implementation.
The Tool Desk
Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →| Implementation | Approval controls | What to verify |
|---|---|---|
| OpenAI Responses API with hosted or remote MCP calls | require_approval can require review, and allowed_tools can restrict which tools are available. The application handles the approval-request and approval-response flow; a decision applies to one call. |
Confirm the tools exposed to the workflow, which calls trigger approval, and that the application resumes only after the decision for that pending call. |
| OpenAI Agents SDK with local MCP servers | The documented require_approval configuration supports always, never, and per-tool policy mappings. |
Confirm the policy is configured for the intended server and individual tools, and verify it against the SDK version and runtime you deploy. |
These are product-specific options, not universal MCP protocol settings. The MCP tools page is a draft specification and does not require one particular user interaction model. Its human-oversight language is guidance rather than a protocol-wide mandate.
Rank #3
- POWERFUL SECURITY KEY: The YubiKey 5 NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5 NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5 NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
Build the gate around the exact pending call
- Constrain the available tools. Expose only what the workflow needs. Where supported, use
allowed_toolsto limit the imported tool set and configure approvals for consequential operations. - Receive the pending call without executing it. When the runtime indicates that approval is required, retain the specific call and its arguments for review rather than treating the request as authorization to proceed.
- Present a useful review screen. Show the tool name, the target system or record, the action, and the arguments in a readable form. Include enough context to distinguish a production write from a test or preview operation.
- Collect an explicit decision. Make approval and rejection distinct actions. Do not infer approval from a timeout, a closed dialog, or an unrelated confirmation.
- Resume only the approved call. Send the decision through the runtime’s documented approval mechanism. If the person rejects it, do not execute the action.
- Keep reviewed and executed arguments aligned. If the application changes arguments after the reviewer sees them, the person may be approving a different operation from the one sent to the server. Ensure the approved call and executed call correspond.
The API’s approval response is tied to a single tool call; it should not be presented as durable permission for subsequent actions. The documentation does not establish that the API automatically makes arguments immutable after review, so the application must preserve that correspondence.
Keep final authorization and validation in the MCP server
For every request, the server should authenticate the caller, apply that caller’s validated credentials and scope, check permission for the requested action and target, validate the input, and only then execute the operation. OpenAI’s MCP server guide puts the boundary plainly: “Enforce authorization in the MCP server for every request; never rely on the model to decide whether a user has access.”
Rank #4
- POWERFUL SECURITY KEY: The Security Key NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key NFC via USB-A and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
- Authentication establishes who is making the request.
- Authorization determines whether that caller may perform this action on this target.
- Validation checks that the arguments are acceptable before the operation runs.
- Human approval lets a person review a particular proposed call; it does not prove the caller has access.
A client-side gate can be bypassed or misconfigured, and model-generated choices are not access-control decisions. The server must still reject unauthorized or invalid calls, including ones that arrive after a client has reported approval.
Recommended Free Tools
Define rejection, timeout, and handoff-failure behavior
Choose what the workflow does if a reviewer rejects the request, never responds, or the approval exchange fails. A safe implementation fails closed: it does not send the pending write to the server unless the required approval is received for that call. Treat that as an application policy, not as a behavior guaranteed by MCP itself.
Best Value
- Security Key : Protect your online accounts against unauthorized access by using FIDO2 and U2F authentication with T110. It's the world's most protective security key that works with windows, Mac OS, Linux as well as Chrome, Firefox, Edge and many other major browsers.
- Certified with the new FIDO2 standard, T110 provides the benefit of fast login and strong protection against phishing, account takeover as well as many other online attactks.
- Works with : Bank of America, Github, Google, Microsoft, DUO, Twitter, Facebook, Dropbox, Apple, ebay, BINANCE, mor and more.
- Fits USB-A port : Insert the T110 security key into the USB-A port of each service and log in conveniently with one touch
- For the driver download and user guide, please visit TrustKey Solutions Home support page.
Test the gate and the server boundary
OpenAI’s MCP guidance recommends using MCP Inspector to examine and test a server. Test both the review experience and the server’s independent protections; a successful prompt alone does not show that the write path is safe.
- Inspect initialization, the advertised tool list, schemas, and annotations.
- Try representative valid inputs and malformed or out-of-scope inputs.
- Check tool results and error handling, including rejected and failed operations.
- Verify authorization for private data and write operations using callers with different permissions.
- Confirm a rejected, missing, or failed approval does not execute the pending action.
- After deployment, use Inspector against the production endpoint to verify the core behaviors there as well.
Protect production operations after deployment
Approval is one control in a larger production setup. OpenAI’s deployment guidance advises using the host’s secrets system for production credentials, applying timeouts and rate limits to expensive or externally visible tools, removing debug responses and unnecessary personal data, and keeping access tokens and sensitive tool results out of logs.
When choosing infrastructure, assess runtime and dependency support, streaming behavior, cold-start and request latency, network access, data residency and compliance needs, secret management, logging and alerting, and rollback or versioning support. The cited guidance does not establish a universally best hosting provider.
Account for risks a confirmation prompt cannot remove
A reviewer can catch a consequential call before it executes, but approval does not eliminate every risk. Consider what information is sent to third-party servers, whether untrusted content could influence a tool request, and whether a remote tool’s behavior could change. Review what data is shared and log decisions in a way that supports oversight without recording tokens or unnecessarily sensitive results.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
