medium

MCP tools auto-approved or always allowed

The config lists tools in autoApprove or alwaysAllow, so they run without asking.

Why it matters

Anything that writes, sends, deletes or spends money should be confirmed by a person, because the model can be steered by content it reads.

How to fix it

Remove the auto-approve list, or keep only read-only tools in it (the checker still flags any auto-approved tool so you review the list). Keep write, send and delete tools behind a confirmation.

Before

{
  "mcpServers": {
    "github": {
      "command": "npx",
      "args": [
        "@modelcontextprotocol/[email protected]"
      ],
      "autoApprove": [
        "create_pull_request",
        "push_files",
        "get_file_contents"
      ]
    }
  }
}

After

{
  "mcpServers": {
    "github": {
      "command": "npx",
      "args": [
        "@modelcontextprotocol/[email protected]"
      ]
    }
  }
}

Illustrative configs. The checker flags the “before” version with this finding and not the “after” version.

Check your own config