Free to read · no account needed

9 min · mcp

MCP tools, permissions, and approvals

Goal: Treat every MCP tool as a button that changes the outside world—match approval to blast radius.

Best for: Anyone who connected a first server and now sees tool prompts.

Every tool prompt is a chance to Deny. Read the name and arguments before Allow becomes habit.

Tools are functions the model may call (search, create draft, list files). Approvals are how you stay in control. “Always allow” is convenient and dangerous for send/delete/pay.

Every tool is a door. Approvals are locks. Read the permission in plain words before you click Allow—especially write, send, delete, pay.

Read the permission aloud once before Allow. If you cannot explain it to a friend, deny and ask for a narrower scope.

Why beginners skip this

Approving every tool permission at once feels easy—one bad approve can egress. Minimum privilege + human confirm.

Step 1 — Read the tool name before approving

When a prompt appears, read tool name, argument preview, and destination; refuse if you cannot restate it.

Step 2 — Default policy

Default from this table: read light, write heavier, send/delete heaviest—when unsure, escalate approval.

Tool kindDefault
Read / search / listAllow once or Ask
Create draft (you still send)Ask
Send / post / delete / purchaseAsk every time or human-only
Broad filesystem writeDeny until you have a sandbox path
Example

Filled prompt

Job: Connect/review scopes for “MCP tools, permissions, and approvals”. Prefer read/draft. Ask-every-time on leave-the-system.
Boundaries: draft only; Unknowns [?]; no silent send; no invented metrics.
Return: checkable artifact + one-minute pass/fail for mcp-tools-permissions-and-approvals.

What good output looks like

  • Matches named constraints for “Treat every MCP tool like a button that can change”
  • Unknowns labeled; no invented owners/metrics
  • Stops before irreversible actions
  • Pass/fail markable in ≤60s

Step 3 — Session hygiene

If you mashed Always allow, revoke or reconnect and reset; write which tools you trust this week and park it by the screen.

Example

Filled prompt

Approvals screen shows: mail.read, mail.send, calendar.write all "always allow".
Rewrite approvals to match blast radius: read can auto; send/write ask-every-time.
Return before/after table. I will revoke one write today.

What good output looks like

  • Ask-every-time on leave-the-system tools
  • Kill-switch owner named
  • Pass/fail: dry-run only today
  • Read/draft preferred over write for “Treat every MCP tool like a button that can change”

Save this card

Card: Treat every MCP tool as a button that changes the outside world—match approval to blast radius. Keep this beside the tool; read before you start.

Before you start

Open the MCP panel on the account you keep. For “Treat every MCP tool like a button that can,” decide read/draft vs write before any Connect. Ask-every-time on leave-the-system. Guide: mcp-tools-permissions-and-approvals. Keep the real job visible the whole time; a blank box means stop and fetch the artifact first.

How to use this week

This week list tools on a real MCP: each tool read / write / external; any out-of-ring action needs human confirm.

Say it aloud

Before Allow, read the scope in one sentence you could text a friend. If you cannot, Deny.

Default deny writes

Week-one default: read and draft. Writes earn trust with a named job.

Keep it real

Run this guide’s Practice now on work you will actually ship this week—not a fictional scenario. Dated notes beat perfect theory.

Do not bookmark-only

Finish Practice now, then tick this guide on your path. Titles unread are not skills.

Reality check

Open this guide beside a live task. If you cannot name the task, pick one before reading further.

Close the loop

Write one line: next time I approve every tool permission at once, I refuse go.

Example

Filled prompt

Live artifact this week for: Treat every MCP tool like a button that can change something—set approvals to match blast 
Name real files/people. No invented facts; label Unknowns; stop before send/delete.
Return working prompt + one pass/fail check I can mark in a minute.

What good output looks like

  • Kill-switch owner named
  • Read/draft preferred over write for “Treat every MCP tool like a button that can change”
  • Pass/fail: dry-run only today
  • Ask-every-time on leave-the-system tools

Red flag

Send/delete without a human gate; approvals mismatched to blast radius—raise the gate.

Pitfalls

PitfallFix
Approving unread argument previewsRead first
Always-allow for send toolsNever for high radius
Same policy for all serversPer-server least privilege
Example

Filled prompt

Temptation: skip the habit for mcp-tools-permissions-and-approvals to save five minutes.
Job still: Treat every MCP tool like a button that can
Smallest correct pass: Done visible · checkable artifact · Unknowns [?].
Boundaries: draft only; no silent send; no invented metrics.
Return: artifact + refuse-line said aloud.

What good output looks like

  • Names the shortcut refused (specific to mcp-tools-permissions-and-approvals)
  • Still delivers checkable output for “MCP tools, permissions, and approvals”
  • Unknowns labeled; draft-only
  • Pass/fail: refuse-line dated (mcp-tools-permissions-and-approvals #4)

Practice now

Least set: start with zero tools; add one with why (Asia/Shanghai).

Screenshot perms: save permission dialog screenshot on Save (Asia/Shanghai).

Deny default: new tools start denied until a why-line exists (Asia/Shanghai).

Click-map drill: list every approval click required this run (Asia/Shanghai).

Approvals drill: list which tool calls require human click—empty list is a smell (Asia/Shanghai).

Thin-spot drill: rewrite the Save card with real nouns from your work (repo, doc, inbox). Generic placeholders fail the drill.

Tonight split a real MCP tool set into low/high risk columns; high-risk runs only after approval.

One sentence takeaway

Each tool read / write / external; out-of-ring always needs human confirm.

Word-floor practice

Run the Today card once on a real artifact. Write pass/fail + never-do with date Asia/Shanghai. If you only skimmed, do not mark this guide done.

Next

Least privilege · Blast radius · Safe first server

← Back to home · Learn · Tools · Compare · Start