Skip to main content
Glama
Approval Gate MCP

Approval Gate MCP

approval-gate-mcp

An MCP server and library for requesting a human decision before a consequential agent action. Approvals expire, are single-use and can bind an operation to an exact payload.

The trusted executor must enforce the approval. Installing an MCP server does not prevent an agent from using another tool, and the gate is not a security boundary against processes with the same OS-user privileges. Read the trusted execution boundary and threat model before integration.

Release and verification

As of 31 October 2026, v0.4.1 on GitHub and 0.4.1 on npm are published. Source changes, GitHub releases and registry publication are separate states; these links identify the released version.

Requires Node.js 22+. See the MIT license, changelog and test suite. The 0.4.1 release notes describe the shipped changes. Tests apply to the revision and environment where they ran; they do not establish production certification. The quickstart below pins the published package; run npm test for your own checkout.

Related MCP server: actionproxy

Why

Sending, deleting, publishing, spending and deploying need a decision tied to the actual operation. A general instruction to "ask first" leaves the executor to interpret an informal conversation. This project records a specific request, a human decision, an expiry and a single-use consume step that trusted execution code can enforce.

Use it when you control that execution boundary. If an agent can bypass it through a shell, another tool or direct file access, adding this server alone cannot enforce approval.

30-second quickstart

claude mcp add approval-gate -- npx -y @itcustomsolution/approval-gate-mcp@0.4.1

Claude Desktop (claude_desktop_config.json):

{
  "mcpServers": {
    "approval-gate": {
      "command": "npx",
      "args": ["-y", "@itcustomsolution/approval-gate-mcp@0.4.1"]
    }
  }
}

Approve or deny from your terminal with npx -p @itcustomsolution/approval-gate-mcp@0.4.1 approval-gate list.

Example

  1. Your agent wants to email a customer. It calls request_approval with action: "send email to alice@example.com, subject: Invoice 1042" and gets back id a1b2c3d4e5f6.

  2. It calls wait_for_approval. Nothing is sent.

  3. In your own terminal: approval-gate list, then approval-gate approve a1b2c3d4e5f6 looks right.

  4. The agent can observe approved, but that status does not authorize sending. The trusted executor calls executeApproved for that id and the exact action (plus operation/payload binding, if present) immediately around its send function. See Trusted execution boundary. It must not accept an agent-supplied or MCP JSON result as proof. Denial, timeout or expiry prevents a successful consume.

  5. ~/.approval-gate/audit.jsonl now has the request and your decision.

Design principles

  • Fail closed. The only thing that authorizes an action is a successful consume: consume_approval returning ok: true (once, for the exact approved action), or executeApproved in trusted code. Pending, approved-but-not-consumed, denied, expired, timeout, error: none of those is an authorization; all of them mean no.

  • The gate never executes anything. It records intent and decisions. Your agent asks first, then acts only on approval. Separation of decision and execution keeps the gate simple and auditable.

  • Decisions are out-of-band. A human approves or denies with a CLI in their own terminal, not inside the agent's context. The MCP tools cannot approve. The CLI asks for an interactive terminal and a re-typed confirmation, which is a speed bump, not authentication: anything running as your OS user (a shell, a PTY, or file access) can still get past it. See Threat model.

  • Only a consume authorizes. status: "approved" is informational. Status responses carry authorizesExecution: false and an effectiveStatus (approved_unconsumed, approved_expired, consumed, revoked, ...). Trusted code that performs the side effect should call executeApproved (see Trusted execution boundary), which consumes the approval itself. A consume result that arrived over MCP, from a file or from an agent is never proof of approval, however well-formed.

  • Everything is audited. Every request, decision, expiry, and consumption is appended to ~/.approval-gate/audit.jsonl (an append-only convention, not a tamper-proof log).

  • Requests expire. Default TTL is 1 hour; a stale approval is not an approval.

  • Approvals are single-use and bound to the action. consume_approval succeeds once, only for the exact action text that was approved (and, if the request carried them, the same operation name and the same canonical JSON payload), and only if the clock read after all of its persistence is still at or before the request's expiry.

Install

Requires Node.js 22 or later (Node 18 and 20 are past end of life; the MCP SDK's @hono/node-server dependency needs Node 20+).

From npm:

npm install -g @itcustomsolution/approval-gate-mcp@0.4.1   # installs `approval-gate` and `approval-gate-mcp`

From source:

git clone --branch v0.4.1 --depth 1 https://github.com/itcustomsolution/approval-gate-mcp.git
cd approval-gate-mcp
npm ci --ignore-scripts
npm test        # builds the source and runs the tests
node dist/cli.js list

Wire it into an MCP client

Claude Code:

claude mcp add approval-gate -- node /path/to/approval-gate-mcp/dist/index.js

Or in any MCP client config:

{
  "mcpServers": {
    "approval-gate": {
      "command": "node",
      "args": ["/path/to/approval-gate-mcp/dist/index.js"]
    }
  }
}

Tools

Tool

Purpose

request_approval

Register an intended action (action, reason, optional ttl_seconds, optional operation and JSON payload to bind). Returns an id (and payloadDigest).

check_approval

Poll a request's status: pending / approved / denied / expired.

wait_for_approval

Block up to timeout_seconds for a decision. Timeout = still pending = not approved.

list_pending

List requests awaiting a human, oldest first, one page at a time (limit 1-100, default 50; pass nextCursor back as cursor).

consume_approval

Call right before acting. Succeeds once, only if approved, unexpired, and action (plus operation/payload, if the request had them) matches exactly. Anything else: do not proceed. Its JSON result is not a transferable credential.

decide_approval

Deny a pending request, or revoke an approved one that has not been consumed. Approving through MCP is refused by default, so an agent cannot approve its own request; approvals come from the CLI. Operators can opt in with APPROVAL_GATE_ALLOW_MCP_APPROVE=1 (not recommended).

The human side

approval-gate list                # pending requests
approval-gate show a1b2c3d4e5f6
approval-gate approve a1b2c3d4e5f6 looks right, ship it
approval-gate deny a1b2c3d4e5f6 wrong recipient
approval-gate revoke a1b2c3d4e5f6 changed my mind   # approved but not yet consumed
approval-gate list approved --limit 20 --after a1b2c3d4e5f6   # page through history
approval-gate archive --older-than-days 30          # retention: move finished requests aside

show and the approve confirmation print the operation and the full canonical payload (escaped) when a request binds one: that is exactly what an executor will be allowed to run.

Suggested agent policy

Put something like this in your agent's system prompt or policy file:

Before any outbound or destructive action (send, publish, delete, purchase, deploy), call request_approval and then wait_for_approval. When it returns approved, call consume_approval with the same id and exact action text, and proceed only if it returns ok: true. Never call decide_approval for your own requests.

Trusted execution boundary

When your own code (not the agent) performs the side effect, let the gate consume the approval at that boundary and run exactly the approved payload:

import { executeApproved } from "@itcustomsolution/approval-gate-mcp/dist/store.js";

// id comes from the agent; the action, operation and payload are what your code is about to run.
await executeApproved(id, { action, operation: "smtp.send", payload: { to, subject, body } }, async (ctx) => {
  ctx.assertActive();          // re-check expiry immediately before the side effect
  await smtp.send(ctx.payload); // ctx.payload is a frozen copy of what the human approved
});

executeApproved accepts no receipt. It performs the single-use consume itself (binding to the action text, and to the operation and payload if the request carried them), writes an execution_started audit line (fsync), checks expiry again, and only then calls your function. If the start record cannot be written, or the approval expired during that write, nothing runs. Call ctx.assertActive() again after any await that precedes the side effect.

assertConsumed(result, id, action, binding?) remains for code that calls consumeApproval itself: it accepts only a grant object issued by consumeApproval in the same process, once, for the same id/action/binding, before expiry. A copy, a JSON round trip (an MCP response, a file, an agent message) or a hand-built object is always refused. 0.3.0 accepted any well-shaped object; see the changelog.

Crash and replay semantics. Consumption is at-most-once: once .used is claimed the approval is spent, whatever happens next, including refusals after the claim (expired during persistence, audit failure). A crash after execution_started and before execution_finished means the outcome is unknown: inspect the external system and, if needed, create and approve a new request. Nothing is retried automatically, and there is no atomic guarantee between this gate's files and the external system your callback touches. Details: docs/authorization-states.md.

Limits

Limit

Value

action, reason, decision reason

8192 UTF-8 bytes each

requested_by

256 bytes (self-reported, never authenticated)

operation

1-128 of A-Z a-z 0-9 . _ : / -

payload

JSON only; 32 KiB canonical (RFC 8785), depth 32, 10000 values; no "__proto__" key

TTL

MCP: integer 10 s to 7 days; library: any finite number up to 7 days (zero or negative gives an already-expired request)

Requests awaiting a decision

APPROVAL_GATE_MAX_PENDING, default 100, 1 to 10000. Concurrent creators can overshoot by at most their own number. Invalid values fail closed.

List page

1-100 (default 50)

State directory

New requests are refused at 100,000 entries in requests/; listing refuses above 200,000. Reading, deciding, consuming and archive work at any size.

When the queue is full, request_approval fails with approval queue full until a human decides requests or they expire. Finished requests stay on disk until you run approval-gate archive, which moves only finished requests that were created and expired at least 8 days ago, so nothing archived can still be used. An MCP client can create and deny its own requests without a human, so it can fill requests/ up to the creation limit; that blocks new requests (an availability limit, like the queue cap), never a human's decisions. Each listing page reads every request file, so listing slows down as history grows until you archive. Paginated listing streams directory entries and retains at most the requested page plus one continuation summary, without payload text. The legacy listRequests API intentionally returns all matching full records and is not memory-bounded by page size.

State

Everything lives in ~/.approval-gate/ (override with APPROVAL_GATE_DIR): requests/*.json for current state, requests/*.final / *.used one-time decision and consumption markers, audit.jsonl for the history and archive/ for archived requests. The directory is created 0700 and files 0600.

Privacy: action text, reasons, requested_by and any bound payload are stored in plain text in these files, and action text and reasons are copied into audit.jsonl. Do not put credentials or secrets in them.

Threat model

What the gate does protect against:

  • An agent that can only reach this server over MCP approving its own request (MCP cannot approve).

  • An agent driving the CLI from a non-interactive shell (approve requires a TTY plus a typed confirmation).

  • Reusing one approval for a second or different action (consume_approval is single-use and action-bound).

  • Using an approval after the request's expiry, races between approve/deny/expiry, guessed ids (128-bit random), malformed or hand-edited state files without a matching decision record, and terminal escape sequences, bidirectional overrides and invisible characters in request text that try to disguise what you are approving (the CLI shows them as \u escapes). Ordinary look-alike letters from other scripts (a Cyrillic "а" in a hostname) are shown as they are: read request text, do not skim it.

What it does not protect against:

  • Trust limitation, not a bug that has been fixed: an agent with a shell, a PTY, or file access as your OS user. It can drive a pseudo-terminal, edit ~/.approval-gate/, or simply skip the gate and perform the action. The gate is a cooperation protocol plus an audit trail, not a sandbox. For hard enforcement, run the agent as a separate OS user (or in a container) that cannot read or write the gate directory, and keep the gate's CLI for yourself.

  • The actual payload. consume_approval matches the action text. It cannot prove that the email, SQL, or deploy the agent then runs equals what you read. That binding is cooperative. See docs/design-trusted-executor.md for an enforced design (proposal only).

  • Unattended, consequential use. Without OS-level separation (see above), do not treat this gate as the only control for unattended agents doing irreversible things. Keep those paths fail-closed, with no automatic execution.

  • An agent that never calls the gate. Enforcement of asking is up to your agent's policy and tooling.

  • Tampering with audit.jsonl by anyone with write access to it.

executeApproved and payload binding are local safeguards: they make the executed payload equal the approved one when your trusted code uses them. They do not authenticate the human or stop a same-user agent from bypassing the gate. A separately trusted authority/executor would still need:

  1. The executor running as a different OS user, container or service account that the agent cannot control, holding the only credential for the side effect.

  2. A gate state directory the agent's user cannot read or write.

  3. Human approval made with a credential the agent does not have (for example a hardware-key signature or an OS prompt for another user), not a TTY.

  4. The agent asking the executor to run an approved id by reference, never sending the payload again.

  5. A tamper-evident (hash-chained or off-host) audit log.

None of that is created by this package; it needs an owner decision and new credentials. See docs/design-trusted-executor.md.

Setting APPROVAL_GATE_ALLOW_MCP_APPROVE=1 re-enables approval over MCP and removes the main protection. Only use it when a human is the only one driving the MCP client.

State transitions, revocation, and crash behavior are specified in docs/authorization-states.md. approval-gate revoke <id> (or deny on an approved request) cancels an approval that has not been consumed yet.

Why so small?

The package concentrates on requests, decisions, expiry, consumption and local records. Your integration supplies the actual operation and decides where to enforce it. Keeping that responsibility explicit makes the boundary easier to review and the limitations easier to test.

Applying the gate to a workflow

This is an inspectable approval component. A working integration still needs a trusted executor, access controls, failure handling and end-to-end acceptance checks for the actual operation. A package install or passing test suite does not establish that a live workflow enforces approval or meets a compliance requirement.

For help defining owners, exceptions and evidence around one IT workflow, see ITC's IT Operations Workflow Review. Implementation and operation are separately scoped; the review does not supply an enforcement boundary or certify an integration.

Contributing

Issues and pull requests are welcome. Keep changes small and fail-closed: anything that could turn a "no" into a "yes" needs a test. Run npm test before opening a PR. See CHANGELOG.md for release history.

License

MIT, see LICENSE.


Built by Olufela "Lu" Fagbure · itcustomsolution.com · MIT license

Available Tools

6 tools
check_approvalA

Check the current status of an approval request. Informational only: no status here authorizes execution (authorizesExecution is always false). See effectiveStatus (approved_unconsumed, approved_expired, consumed, revoked, ...). Only consume_approval ok:true authorizes.

NameRequiredDescriptionDefault
idYesThe request id returned by request_approval

TDQS

A4.2/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations provided, the description carries the full burden and does well: it declares that authorizesExecution is always false and enumerates the effectiveStatus values (approved_unconsumed, approved_expired, consumed, revoked), which is the key behavioral fact an agent needs to avoid treating a check as a clearance. It omits any note on side effects or permissions, though for a pure read that is minor.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Three short sentences, with the core purpose and the safety-critical constraint front-loaded and no wasted words. Every clause (informational-only, status fields, consume_approval handoff) earns its place.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

No output schema exists, so the description must explain return values, and it does name the two fields that matter most (authorizesExecution and effectiveStatus). It does not sketch the remaining status values or response shape, leaving a small gap for a tool whose entire output is status data.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Only one parameter and schema description coverage is 100% – the schema already documents id as "the request id returned by request_approval". The description adds no format, sourcing, or lookup guidance beyond that, so the baseline of 3 applies.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb and resource ("Check the current status of an approval request") and explicitly separates itself from consume_approval, the sibling that actually authorizes execution. An agent can tell exactly which tool performs a status read versus an authorization.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Gives an explicit when-not ("no status here authorizes execution") plus the correct alternative ("Only consume_approval ok:true authorizes"). It does not route against the other read-oriented siblings (list_pending, wait_for_approval), so it falls just short of full when/when-not/alternatives coverage.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

consume_approvalA

Call this IMMEDIATELY before performing an approved action. Succeeds exactly once per request, only if the request is approved, not past its expiry, action is byte-for-byte the text that was approved, and operation/payload (if the request had them) are identical. ok:false for any reason means do NOT proceed. An approval cannot be reused for a second or different action. The returned JSON is not a transferable credential: no other component may accept it as proof of approval.

NameRequiredDescriptionDefault
idYesThe request id returned by request_approval
actionYesThe exact action text you passed to request_approval
payloadNoOptional JSON payload the action will execute (at most 32768 bytes canonical). The human reviews it; consume must present an identical payload.
operationNoOptional operation name a trusted executor must present, e.g. 'smtp.send' (A-Z a-z 0-9 . _ : / -)

TDQS

A4.8/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description carries the full burden and does so: exactly-once success, the four preconditions (approved state, unexpired, byte-for-byte action match, identical operation/payload), failure semantics, and a security caveat that the returned JSON is not a transferable credential. These are non-obvious behaviors an agent could not derive from the schema alone.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The imperative directive is front-loaded in the first clause, and every subsequent sentence adds a distinct, load-bearing constraint (preconditions, abort rule, no-reuse, credential warning). No filler or repetition of schema content.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a 4-parameter mutation-like tool with no annotations and no output schema, the description covers the critical failure path ('ok:false') and the credential caveat, but does not indicate what a successful response contains beyond implying `ok:true`. That is a minor gap given the otherwise thorough disclosure.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100%, so the baseline is 3; the description earns above that by sharpening the matching rules — `action` must be 'byte-for-byte the text that was approved' and operation/payload must be identical if the request had them. It reinforces the strictness of the match rather than restating field types.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description states a specific action (consume an approval) and its precise placement in the workflow: 'Call this IMMEDIATELY before performing an approved action.' That timing constraint, plus the exactly-once semantics, cleanly separates it from the sibling lifecycle tools (request_approval, check_approval, wait_for_approval, decide_approval).

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

It gives an explicit when ('IMMEDIATELY before performing an approved action'), an explicit when-not ('ok:false for any reason means do NOT proceed'), and an explicit non-reuse rule ('An approval cannot be reused for a second or different action'). The agent is told both the trigger and the abort condition without inference.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

decide_approvalA

Deny a pending request, or revoke an approved-but-unconsumed one. Approvals are not possible through MCP; a human must run approval-gate approve <id> in their own terminal.

NameRequiredDescriptionDefault
idYesThe request id returned by request_approval
reasonNoHuman's stated reason, verbatim
approveYestrue to approve (refused unless enabled by the operator), false to deny

TDQS

A3.7/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description carries the full behavioral burden. It usefully discloses the out-of-band approval constraint and the two state transitions it causes, but says nothing about what happens on failure (e.g. request already consumed), whether denial is reversible, or how `reason` is used — and it does not reconcile the tension with the schema's `approve` parameter, which can still be set to true when the operator enables it.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Two tight sentences, no filler, with the primary action stated first and the hard constraint immediately after. Every clause earns its place.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a 3-parameter state-mutating gate tool with no output schema, the description covers the main paths and the human-approval constraint. It is still thin on error behavior and post-denial state, which an agent needs before committing to a mutation.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100%, so id, reason, and approve are already fully documented, establishing the baseline of 3. The description adds only indirect meaning about the approve flag and nothing about the format or purpose of `reason`.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb and resource: denying a pending request or revoking an approved-but-unconsumed one. That scope implicitly separates it from request_approval and consume_approval, though no sibling is named explicitly.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Clearly frames the two valid use cases (deny pending, revoke unconsumed) and adds the critical when-not: an agent cannot approve through MCP and must direct a human to run the CLI. It stops short of routing to a specific sibling tool by name.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

list_pendingA

List approval requests awaiting a human decision, oldest first, one page at a time. Returns {items, nextCursor}; nextCursor is present only when more requests exist (pass it back as cursor). Items omit payload text; use check_approval for one full request.

NameRequiredDescriptionDefault
limitNoPage size, 1-100 (default 50)
cursorNonextCursor from the previous page

TDQS

A4.5/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description carries the full burden and does well: it discloses the return envelope {items, nextCursor}, that nextCursor is conditional, and that item payloads are truncated. It does not state the operation is read-only or note any permission/auth expectations, which is a modest remaining gap for a no-annotation tool.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Three short sentences, front-loaded with purpose, then return shape, then the escalation path to check_approval. No filler and no repetition of schema details.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

No output schema exists, and the description compensates by describing the response envelope and paging contract. An agent has everything needed to paginate correctly and to know when to escalate to a detail tool.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is already 100%, so the baseline would be 3, but the description adds real meaning: it explains that cursor is a nextCursor fed back from a prior page and that nextCursor only appears when more results exist. This clarifies the paging loop in a way the schema's one-line field descriptions do not.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb and resource ("List approval requests awaiting a human decision") plus ordering and paging scope, and names the sibling that serves single-record reads. An agent can distinguish it from check_approval and the decide/consume siblings without opening any schema.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

"Items omit payload text; use check_approval for one full request" gives an explicit alternative and the condition that selects it. There is no exclusion for the remaining siblings (wait_for_approval, decide_approval), so the routing guidance is clear but not exhaustive.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

request_approvalA

Register a consequential action for human approval BEFORE performing it. Returns a request id. The action is NOT executed by this server; status 'approved' does NOT authorize anything by itself. Right before acting, call consume_approval with the same id, the exact action text and the same operation/payload if you supplied them; proceed only on ok:true. Anything else means no (fail closed).

NameRequiredDescriptionDefault
actionYesPrecise description of the action you intend to take, e.g. 'send email to alice@example.com with subject X'
reasonYesWhy this action is needed right now
payloadNoOptional JSON payload the action will execute (at most 32768 bytes canonical). The human reviews it; consume must present an identical payload.
operationNoOptional operation name a trusted executor must present, e.g. 'smtp.send' (A-Z a-z 0-9 . _ : / -)
ttl_secondsNoHow long the request stays valid, pending or approved (default 1 hour)
requested_byNoIdentifier of the requesting agent or workflow (self-reported, not authenticated)

TDQS

A4.8/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations exist, so the description carries the full burden and does so: it discloses that the server does not execute the action, that an 'approved' status is not authorization, that a request id is returned, and that the system fails closed. These are exactly the non-obvious behavioral traits an agent would otherwise get wrong.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Four tight sentences, front-loaded with the purpose, then the return value, then the critical caveat, then the next step. No filler and the ordering matches the agent's decision sequence.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

With no output schema, the description correctly supplies the return value (a request id). The only gaps are secondary: it does not say what happens when ttl_seconds expires or how a pending request becomes visible to a human, both of which are covered by siblings like wait_for_approval and list_pending.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100%, so the baseline is 3; the description earns above that by explaining the cross-call coupling — operation and payload supplied here must be re-presented identically at consume time — which is the parameter behavior most likely to cause silent failure. It does not add anything for ttl_seconds or requested_by, but those are self-explanatory in the schema.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb and resource ('Register a consequential action for human approval') and immediately pins down the workflow position: BEFORE performing it. It also names the follow-up sibling consume_approval, so an agent can tell this apart from check_approval/decide_approval without opening a schema.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Explicit about when to call (before a consequential action), what to do next (consume_approval with the same id, action text, operation/payload), and the decision rule ('proceed only on ok:true. Anything else means no (fail closed)'). This is the rare description that leaves nothing to inference.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

wait_for_approvalA

Block until a human decides the request, it expires, or the timeout elapses. Returns the final (or still-pending) request. Informational only; it never authorizes execution. A timeout returns 'pending' (not approved). After 'approved', call consume_approval and proceed only on ok:true.

NameRequiredDescriptionDefault
idYesThe request id returned by request_approval
poll_secondsNoPolling interval
timeout_secondsNoMaximum time to wait (default 5 minutes)

TDQS

A4/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description carries the full burden and does well: it discloses that the call blocks, that a timeout yields 'pending' rather than approval, and that approval alone does not permit execution. Missing are operational notes such as whether long blocks are safe or how concurrent waits behave.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Four short sentences, front-loaded with the blocking behavior and followed immediately by the safety caveat and the required next step. Only the clause 'Returns the final (or still-pending) request' adds little beyond what precedes it.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

No output schema and no annotations, and the description covers the critical contract: what blocks, what a timeout means, and how to proceed after approval. The returned request's shape and status values are not described, but the decision-relevant behavior is complete.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100%, so the schema already documents id, poll_seconds and timeout_seconds and the baseline is 3. The description adds real meaning by explaining the consequence of the timeout parameter returning 'pending' rather than approved, which the schema does not convey.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb and effect: block until a human decides, the request expires, or the timeout elapses, then return the request. An agent can tell this is a waiting/polling call rather than a decision call. However, it never explicitly names check_approval as the non-blocking alternative, so the wait-vs-check distinction is left implicit.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Gives a clear call sequence: after 'approved', call consume_approval and proceed only on ok:true, plus an explicit 'never authorizes execution' exclusion. It stops short of saying when to prefer check_approval or how to pick a timeout, so the guidance is contextual but not exhaustive.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Tool Schema Changelog

Recent tool additions, removals, and schema changes observed during successful MCP inspections.

  1. 6 tool updatesv0.4.1
    • Changedcheck_approval1 field changed
      • removedInput schema / additionalProperties
        Removed value: -false
    • Changedconsume_approval1 field changed
      • removedInput schema / additionalProperties
        Removed value: -false
    • Changeddecide_approval1 field changed
      • removedInput schema / additionalProperties
        Removed value: -false
    • Changedlist_pending1 field changed
      • removedInput schema / additionalProperties
        Removed value: -false
    • Changedrequest_approval1 field changed
      • removedInput schema / additionalProperties
        Removed value: -false
    • Changedwait_for_approval1 field changed
      • removedInput schema / additionalProperties
        Removed value: -false
  2. 6 tool updatesv0.4.0
    • Changedcheck_approval1 field changed
      • addedInput schema / properties / id / maxLength
        Added value: +64
    • Addedconsume_approval
    • Changeddecide_approval4 fields changed
      • changedInput schema / properties / approve / description
        Previous value: -"true to approve, false to deny"New value: +"true to approve (refused unless enabled by the operator), false to deny"
      • addedInput schema / properties / id / description
        Added value: +"The request id returned by request_approval"
      • addedInput schema / properties / id / maxLength
        Added value: +64
      • addedInput schema / properties / reason / maxLength
        Added value: +8192
    • Changedlist_pending3 fields changed
      • addedInput schema / additionalProperties
        Added value: +false
      • addedInput schema / properties / cursor
        Added value: +{
        +  "description": "nextCursor from the previous page",
        +  "maxLength": 64,
        +  "minLength": 1,
        +  "type": "string"
        +}
      • addedInput schema / properties / limit
        Added value: +{
        +  "default": 50,
        +  "description": "Page size, 1-100 (default 50)",
        +  "maximum": 100,
        +  "minimum": 1,
        +  "type": "integer"
        +}
    • Changedrequest_approval7 fields changed
      • addedInput schema / properties / action / maxLength
        Added value: +8192
      • addedInput schema / properties / operation
        Added value: +{
        +  "description": "Optional operation name a trusted executor must present, e.g. 'smtp.send' (A-Z a-z 0-9 . _ : / -)",
        +  "maxLength": 128,
        +  "type": "string"
        +}
      • addedInput schema / properties / payload
        Added value: +{
        +  "description": "Optional JSON payload the action will execute (at most 32768 bytes canonical). The human reviews it; consume must present an identical payload."
        +}
      • addedInput schema / properties / reason / maxLength
        Added value: +8192
      • changedInput schema / properties / requested_by / description
        Previous value: -"Identifier of the requesting agent or workflow"New value: +"Identifier of the requesting agent or workflow (self-reported, not authenticated)"
      • addedInput schema / properties / requested_by / maxLength
        Added value: +256
      • changedInput schema / properties / ttl_seconds / description
        Previous value: -"How long the request stays pending before it expires (default 1 hour)"New value: +"How long the request stays valid, pending or approved (default 1 hour)"
    • Changedwait_for_approval1 field changed
      • addedInput schema / properties / id / maxLength
        Added value: +64
  3. 5 tool updatesv0.1.0
    • First observedcheck_approval
    • First observeddecide_approval
    • First observedlist_pending
    • First observedrequest_approval
    • First observedwait_for_approval

TDQS

A4.2/5.0

Scored across 6 tools

Disambiguation4/5

Each tool maps to a distinct lifecycle stage: register, poll, block, enumerate, deny/revoke, and consume. The only fuzzy cluster is check_approval vs wait_for_approval vs consume_approval, all of which report status; the descriptions do explicitly separate them (informational poll vs blocking wait vs single-use authorization), which keeps misselection recoverable but still requires careful reading.

Naming Consistency4/5

Five of six tools follow a clean verb_noun pattern (request_approval, check_approval, wait_for_approval, decide_approval, consume_approval). list_pending breaks the pattern by omitting the noun object (implied 'approvals'), a minor deviation but still readable and unambiguous.

Tool Count5/5

Six tools is well-scoped for an approval gate: one per lifecycle operation with no redundant entries. Nothing feels padded or missing on the surface.

Completeness4/5

Covers the full request-poll-wait-list-decide-consume loop, with the notable and intentional absence of an MCP-side approve (humans approve out-of-band). Minor gap: there is no way to enumerate decided/expired/consumed requests by status, so an agent that lost a request id can only recover via paginated list_pending.

Maintenance

ActivityActive
ResponsivenessNo issues

Related MCP Connectors

Related MCP Servers

  • A
    license
    A
    quality
    D
    maintenance
    Human-in-the-loop approval gate for AI agents. Your agent calls submit_approval before any irreversible action; a human reviews on a branded page; a signed webhook fires back with the decision.
    1
    1
    MIT
  • A
    license
    Not graded
    quality
    C
    maintenance
    A local human-in-the-loop gate for AI agents that blocks actions until human approval, with timeout defaulting to denial.
    31 npm
    MIT
  • A
    license
    A
    quality
    B
    maintenance
    Human approval for AI agents: request_human_approval pauses a high-stakes action until a named person approves or rejects (console, email, Telegram, Slack); silence is not consent. Every decision is sealed in a hash-chained audit log. EU-hosted.
    3
    47 PyPI
    1
    MIT