Which practices represent good host-side approval UX for MCP tool calls?

MCP does not sandbox tools at the protocol level. The **host** application is where security lives, and the approval prompt is the user's only real checkpoint before a tool runs. Good approval UX gives the user enough to make a real decision. It shows the tool name, which server it came from, and a plain-language summary of what will be read or changed. It also shows the full tool description, because a malicious server can hide instructions there to trick the model. Letting the user see it lets them catch the trick. It also matches friction to risk. A file write or a network call deserves its own prompt every time. A batch of harmless reads can be approved together so the user is not buried in pop-ups. The bad patterns are the opposite. One 'allow all from this server' button hands over blanket trust. Silently auto-approving anything labeled read-only skips the user entirely, even when that read returns sensitive data.

MCP leaves enforcement to the host, so the approval prompt is the security boundary, not a formality. Informed consent comes first. The host must show the tool name, the originating server, and a plain-language summary of what data gets accessed or modified. It should also surface the full tool description the model sees. That matters because a server can embed hidden instructions in that text, a tool poisoning attack, and only an honest UI lets the user catch it. Consent should also scale with risk. File writes and outbound network calls warrant an individual prompt each time. Low-risk reads can be batched into one approval so the user is not trained to click through pop-ups blindly. Server attribution belongs on every prompt so users know which external service owns each tool. The two distractors break the model. A single 'allow all from this server' button is a blanket grant. It surrenders per-call consent and hides a later rug pull, where the server quietly changes a tool after approval. Auto-approving read-only tools with zero interaction is just as bad. A read can still exfiltrate secrets, so silent approval removes the user's last chance to object.