MCP tools set to run without asking
MediumAV-MCP-104Human oversightMCP config pack
What it finds
Some MCP tools are on an auto-approve / always-allow list, so the AI can call them without asking you each time.
Why it matters
Auto-approval is convenient for read-only tools, but if a tool on the list can write, send, or delete, a manipulated AI can use it silently.
What an attacker could do: The listed tools can run without any human confirmation.
How to fix it
Keep auto-approve lists to read-only tools only. Anything that writes files, sends messages, or changes data should require confirmation.
Pro shows the corrected code for your exact file, step by step, and re-scans to confirm the fix. See plans
Check details
- Finding code
- MCP_TOOLS_AUTO_APPROVED
- How it detects
- Looks for a specific risky pattern in the code or config.
- Confidence
- Definite: the risky setting is written plainly in the file.
- Scans
- MCP client configuration files: claude_desktop_config.json, .cursor/mcp.json, .vscode/mcp.json, .mcp.json
- OWASP LLM Top 10
- LLM08 - Excessive Agency
- NIST AI RMF
- MG-2.2
- SOC 2
- CC6.1
Check your agent for this
Paste your agent code or MCP config. The free scan runs all 124 checks in about 10 seconds — no account needed.
Related checks
- Agent can move money with no amount limitAV-HUMAN-003 · Critical
- Missing human-in-the-loop gatesAV-HUMAN-001 · High
- Built-in safety controls turned offAV-HUMAN-002 · High
- Destructive tool with no confirmationAV-HUMAN-004 · High
- AI editor set to run every tool without askingAV-FW-013 · High
- OpenAI Agents SDK agent with tools but no guardrailsAV-FW-006 · Medium