You can require approval before an MCP tool runs only if the host—the app or agent using the MCP server—provides that control. MCP has no universal switch that forces every client to show a confirmation dialog. For a no-code-change setup, check your host’s approval UI and settings; if it has no suitable control, you cannot enforce a human checkpoint just by changing the MCP server’s tool description or metadata.
First, identify where the approval control lives
MCP defines how clients discover and invoke tools, including the tools/call request. It does not prescribe one confirmation interface or approval setting. The Model Context Protocol tools specification says implementations may expose tools through different interface patterns and recommends that applications show available tools, indicate invocations, and present confirmation prompts. It says there “SHOULD always be a human in the loop with the ability to deny tool invocations.” That recommendation is not a cross-client setting you can turn on in an MCP server. Model Context Protocol tools specification
As an Amazon Associate I earn from qualifying purchases.
Tool annotations are not enforcement either: the specification says clients must treat them as untrusted unless they come from trusted servers. The host or another trusted layer must actually pause dispatch and wait for a person before a call runs. Model Context Protocol tools specification
Do these 3 things before closing this tab:
1Fix the driver behind crashes, sound loss and screen glitches2Clear out junk files and repair common Windows errors3Scan for outdated or missing drivers - takes under a minuteCheck the host you actually use
Approval behavior varies by application, product, and MCP path. A control for a hosted agent does not necessarily apply to a desktop client or a locally configured server. Check the host’s current documentation and installed version, then confirm whether its setting blocks execution until you respond and whether it covers one tool, a server, or a wider scope.
#1 Best Overall
VS Code
- Open the Command Palette and run Chat: Manage Tool Approval.
- Find the MCP server under its source and review the available approval controls. VS Code documents configuration for a source or individual tools.
- To keep a tool from being automatically approved, set that tool to
falseinchat.tools.eligibleForAutoApproval. The guide also documents device-management policies for organizations managing specific tools.
These controls are documented for VS Code; names and availability can change between versions. Check the guide for the version you have installed: VS Code: Use tools in chat and VS Code: Manage tool approval.
Claude Managed Agents
In Claude Managed Agents, MCP toolsets default to always_ask. The policy can be set for a toolset or overridden for an individual tool. With always_ask, the session pauses for an approval decision; the host handles the confirmation event and sends an allow or deny response. These are Managed Agents policies, not a general setting for Claude Desktop, claude.ai, or every MCP client. See Claude Managed Agents permissions.
Rank #2
Do not confuse auto with a human checkpoint. Under that policy, the server may allow, deny, or pause based on its own evaluation; Claude’s documentation explicitly says that “auto is not a human checkpoint.” Use always_ask for a tool that must wait for a person in this environment. Claude Managed Agents permissions
OpenAI Agents SDK
The OpenAI Agents SDK documents requireApproval: 'always' and per-tool approval policies for hosted MCP tools. A call that needs approval interrupts the run; the application must ask a person and resume after approval or rejection. The documented example supplies a confirmation handler and handles interruptions, so this is not a point-and-click setting for an existing deployment. The reference lists the default as never; verify your deployed SDK and agent configuration before relying on the policy. See the OpenAI Agents SDK MCP guide and MCP reference.
ChatGPT and Codex MCP configuration
The reviewed ChatGPT guidance says Codex stores MCP configuration in config.toml and that the desktop app, CLI, and IDE extension share configuration for the same Codex host. It distinguishes that local Codex configuration from hosted ChatGPT plugin tools. This establishes which configuration is shared, but does not establish a universal Codex setting that prompts before every MCP call. Check the current controls for your specific host rather than assuming that a server entry in config.toml enforces approval. OpenAI: Connectors in ChatGPT
If your host has no approval control
There is no server-side annotation that can force an unsupported client to pause. To guarantee a human checkpoint, use a host or orchestration layer that supports blocking approvals, or add an approval step in the application that dispatches the tool call. The Agents SDK example shows the latter pattern: configure approval, handle the interruption, collect a human decision, then resume or reject the run. OpenAI Agents SDK MCP guide
Before choosing a different host or adding an integration, check the behavior you need: Does it block every relevant call until a person responds? Can the policy apply per call, tool, server, workspace, or globally? Does it cover your local or hosted MCP connection? What happens when someone denies a call or does not respond? The reviewed documentation establishes different controls in different products, not a shared behavior across clients.
Review each prompt before approving
An approval prompt is useful only if you inspect what it authorizes. VS Code recommends checking tool names and input parameters, particularly for tools that modify files, run commands, or access external services. Claude’s connector guidance warns that tools can contain malicious hidden instructions or change behavior. VS Code: Use tools in chat Claude MCP connector guidance
Quick Recap
- Check the tool identity and the arguments for this specific call.
- Approve only the action you intend; deny calls whose purpose or inputs are unclear.
- Use persistent trust or “allow always” choices sparingly: future calls may run without the same prompt.
- Disable tools you do not need.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
