What is the MCP host approval model and at what granularity should consent be obtained?

**MCP** lets an LLM app connect to outside servers that offer tools, files, and prompts. But the protocol itself does not decide what is safe. That job belongs to the host, the application the user actually trusts, like Claude Desktop or Cursor. The host sits between the model and every server. Before any tool runs, the host can pause and ask the user, "this server wants to run this tool, allow it?" That checkpoint is the approval model. The model never reaches a server directly; it always goes through the host. Granularity is the key idea. The weakest design asks once and approves everything forever. The strictest asks before every single call. A good host lands in between. It shows which server and which tool, plus a plain description of what gets touched. The rule of thumb: cheap, read-only actions can be waved through, while anything that writes data, sends a request, or touches secrets should ask first. That way the user spends attention only where it matters.

In MCP the host is the trust boundary, not the protocol. The spec defines how servers advertise tools, resources, and prompts. It says nothing about what is allowed to run. The host mediates every tool call. It decides which servers connect, scopes what each may do, and surfaces calls to the user for consent before execution. The model only ever sees what the host chooses to expose. Consent has a granularity dial. Per-server approval is the floor: the user sees which server connects and what tools it carries. For high-risk tools that write data, make network calls, or touch secrets, per-tool or per-category consent is the better default. The two failure modes sit at the extremes. Blanket approve-all gives zero information and lets a destructive write ride in behind a harmless read. Prompting on every call causes approval fatigue, so users rubber-stamp without reading. A good host splits the difference. It allowlists safe read-only tools to run silently. It always prompts on side-effecting ones. Each prompt shows the tool name, server origin, and a plain description of what gets touched, so the decision is actually meaningful.