Where should approval for MCP write tools be enforced?

Reddit r/AI_Agents Tools
mcp approval write-tools agent-safety permissions logging side-effects

Summary

The article discusses where to enforce approval for write actions in MCP tools, considering client-side and server-side approaches, and what to log for checking against approved actions.

An MCP client can connect to a server that exposes both read-only tools and actions that change an external account. I recently tested a local Reddit MCP where browse, search, and post-reading tools are available alongside reply, post, and vote tools. A write only felt safe after someone reviewed the exact text and explicitly approved that single action. For people building or using agents with side-effecting tools, where do you enforce that boundary: client-side approval, server-side permissions, or both? What do you log so the executed action can be checked against what was approved?
Original Article

Similar Articles

Azure DevOps MCP and the confused-deputy problem in agent PR review

Reddit r/AI_Agents

A report on Microsoft's Azure DevOps MCP server reveals a confused-deputy attack where hidden PR text can manipulate AI review agents (Copilot CLI, Claude Code) into unintended tool calls with the user's permissions. Recommendations include using read-only identities and requiring separate approval steps.

Human approval is too vague for production agents

Reddit r/AI_Agents

The article argues that human-in-the-loop in agent systems should move from vague approvals to explicit, auditable step-level signed decision records with detailed evidence, payloads, idempotency keys, rollback paths, and ownership. It highlights the danger of approving a black-box story rather than a specific operation.