MCP Approval for Supported Actions
Review selected MCP actions before Chau7 carries them out.
Availability
Partially implemented in stable. Read the limits below before relying on this workflow.
Reviewed against stable v0.5.1. Rust candidate additions are labeled separately. Release status.
The pain this solves
- Reviewing selected MCP actions can add oversight at Chau7's control boundary.
- A narrow approval gate should not be described as covering every agent tool.
What ships with it
- Stable MCP service has approval paths for supported tab-control and command requests.
- Command prompts include Deny, Allow Once, and Always Allow.
- Approval applies only to covered Chau7 MCP actions when configured or required.
Questions this answers
- Can Chau7 require approval for selected MCP commands?
- Does every MCP tool call require approval?
- Does approval govern commands executed outside Chau7?
How it works
The stable MCP service has approval paths for supported tab-control requests and command execution. Depending on settings and command filtering, Chau7 can show a local prompt or forward an approval request through configured remote control.
Command prompts can offer Deny, Allow Once, and Always Allow. The request type and policy determine whether a prompt is required; this is not an automatic prompt for every MCP method or tool call.
Approval rules and filters apply at Chau7's MCP control boundary. They do not govern unrelated agent tools, shell commands launched outside the covered request path, or all actions by every MCP-compatible client.
Why it matters
Approval prompts are useful when an agent asks Chau7 to perform a supported operation. Naming the covered request types helps users understand where human review occurs.
Frequently asked questions
Does every MCP tool call require approval?
No. Approval applies to supported tab-control and command paths when settings or filters require it.
What choices can a command prompt show?
The stable command approval flow includes Deny, Allow Once, and Always Allow options.
Does this control commands the agent runs outside Chau7?
No. It applies to requests handled by Chau7's MCP service, not arbitrary tools or external shell execution.