Allow tool use by default in Claude

[j-walheim]

Pre-submission Checklist

• I have checked that this question would not be more appropriate as an issue in a specific repository
• I have searched existing discussions and documentation for answers

Question Category

• Protocol Specification
• SDK Usage
• Server Implementation
• General Implementation
• Documentation
• Other

Your Question

Hi,

is there a way to make Claude automatically approve the use of certain tools (or all)? I built an MCP that uses several tools, and it would be great not to approve every tool use every time while testing and developing.

Thank you.

[jspahrsummers]

No, this is intentionally not possible right now, for security + safety reasons. Models are currently not safe enough to blanket trust choices that they make.

[jacksteamdev]

@jspahrsummers Conversely, it would be nice to be able to configure a tool to always require a confirmation. Some tool calls might be intended the first time, but not later.

[g0t4]

If users are prompted repeatedly, that just encourages people to click Yes, Yes, Yes... making it just as risky to force confirm on each tool use IMO.

I appreciate the option for Allow for this chat... that's a nice compromise.

Another idea, could we involve the server in determining the risk of a given tool request? Maybe yes/no (bool) or a probability %... such that the client can determine if it will prompt the user. Conversely, this could be used to override Allow for this chat for a given tool request if the risk is too high.

For example, I have mcp-server-commands which is definitely a tool that you want to review each request... but if a command is something simple like ls, pwd, cat, echo or another readonly (non-destructive) command, it would be nice to tell the client that it is ok (assuming the user has opted in) to bypass prompting the user. Where as rm should be prompted every time...

Another idea would be to use another tool (i.e. another LLM) to score the risk independent of the server used.

Or, both.

If this sounds useful for other servers, let me know.

By the way, a tool to score the risk would be a great example of a tool that could be marked as always safe. I wouldn't want the user to be prompted a second time for each request :) ... Likewise with checking date/time. Or, fetching a web page. Perhaps it would be possible for the tool spec to mention if a tool use is always gonna be low risk and never needs approval? Or, if it might require scoring? So we aren't scoring low risk tool requests.

[g0t4]

yeah there are definitely tools that I want to flag as "don't ask me"... i.e. fetch web pages :)

[g0t4]

also tools around memory use, seems fine to just do it since it's just a scratchpad in my impl

[jacksteamdev]

It's easy to forget the possibility of bad actors.

I'm coming from the browser extension space, and have seen first hand how creative malicious developers can be. We will see this in the MPC space, guaranteed.

Just because I know I'm not doing anything bad doesn't mean my app should be trusted in the wild 😜

[g0t4]

I don't think anyone is discounting that. And don't forget a malicious model too. There has to be a balance between convenience and safety... right now there is very little in the way of convenience. That'll lead people to just click Approve (for chat) repeatedly which is also not "safe" and is arguably riskier than minimizing prompts

[elroy-bot]

Rather than clicking ok for every tool, every session, users would be better served with strong warnings about the risk of running MCP servers from sources you don't trust. In current form this feature is only usable by devs anyways.

Asking for this many confirmations renders the feature unusable

[domdomegg]

I've raised this related specification extension idea: modelcontextprotocol/modelcontextprotocol#114

[beyarkay]

Another point, is that while developing a MCP server it gets old really fast having to approve every tool use for every chat, especially since you often need to restart the claude app to reload the MCP server. Being able to auto-allow tool use during development would make the process much smoother

[olaservo]

Side comment on this: IMO Claude Desktop hasn't been the most effective interface for testing MCP servers during development, partly because of what you mentioned, and partly because you can easily run out of messages on the subscription plan if you do a lot of testing. All that and it also seems to cache old versions of my server unless I specify latest for an npm package for example, or force bump a new server version every time I make a change.

If you're still in the 'active development' phase and doing a lot of testing you might want to use a MCP client or testing tools built into your development environment instead. That way you also have a lot more options for auto-approving actions if all you want to do is efficiently test functionality. Then once things are stable with functional testing you could do more 'user acceptance testing' in the Claude Desktop app once you know your server is stable.

[Mehdi-Bl]

I would like to keep validation. But there tools like reading I Would skipe validation, read/search/websearch for example. As long the Tool don't change the system, I would let approved by default.
I will be always very cautious with execution despite always running that MCP in docker or wrapping the access it can get thru only using make files or some carefully picked tools. Writing/edit is fine, validation once, and some time agree the model can turn Rogue and I switch to each step validation and even checking the action.
Unfortunatly Claude Desktop, Anthropic client, limit the actions, I would even allow WRITE as default and have ability to revoke the permission. But that's more from the client, rather than a protocol as I saw other clients like CLINE, are always approving any MCP use. Similar to other clients.

[g0t4]

common now... just raw dog it! mcp-server-commands :) ... Claude is overly cautious in my experience (and I auto approve ALOT)

[phlax]

i think not allowing anything to be auto-approved is more of a security risk than allowing specific ones

apart from the click, click, click, oops factor - there are now various scripts and workarounds floating around the webs that either blanket allow or wrap claude in some way

[g0t4]

💯... the only people that think otherwise clearly are not even using these tools to do anything meaningful...

[olaservo]

Going to close this since the original question was answered. For further discussion around related topics lets use a separate thread.

[g0t4]

what thread?

the answer is less than satisfactory, i.e. as @phlax mentioned:

i think not allowing anything to be auto-approved is more of a security risk than allowing specific ones

apart from the click, click, click, oops factor - there are now various scripts and workarounds floating around the webs that either blanket allow or wrap claude in some way

[tadasant]

Discussions around how Claude Desktop / Claude.ai handle tool call approval UX are not in-scope for the modelcontextprotocol organization.

If you would like to open a discussion around how this guidance is framed in the protocol itself, please feel free to do so. You probably want to propose a change to this language.