What UX patterns help users make informed MCP approval decisions without approval fatigue?

**Approval fatigue** is the failure mode where an app asks the user to confirm so many tool calls that they stop reading and just click 'allow' on everything. Once that happens, consent is fake. A malicious tool sails through as easily as a safe one. MCP makes this risk concrete. The model reads the tool's full description, and an attacker can hide instructions in that text. This is called **tool poisoning**. If the approval dialog only shows the tool's name, the user never sees the hidden payload the model is actually obeying. Good approval UX fixes this with a few patterns. Show the full description the model sees, not just the name. Show who published the server, so the user can judge whether to trust it. Group the low-risk read-only tools so the user is not interrupted for harmless calls, and stop them only for destructive ones like deleting files or spending money. The goal is simple. Every click a user makes should be a real, informed decision, not a reflex.

Good MCP approval UX treats consent as a security control, not a checkbox. The core tension is information quality versus friction. Too little of either and the user clicks 'allow' blindly. Show what the model sees. Display the full tool description, including the LLM-visible text. Add the server origin and a plain-language summary of what gets read or written. A bare method name hides poisoned instructions an attacker embedded in the description. Fight fatigue by scoping and tiering. Batch-approve low-risk read-only tools so the user is not interrupted for harmless calls. Prompt individually for destructive operations, like file writes or anything that spends money. Surface server provenance, such as a GitHub URL or marketplace listing, as a trust signal. Flag changes. If a tool's definition or its hidden text shifts after the user approved it, re-prompt. This defends against rug pull attacks, where a server quietly swaps a benign tool for a malicious one post-approval. Also flag invisible or suspicious characters in descriptions. Avoid blanket 'allow all from this server'. It collapses every future call to zero real consent. The win is that each decision the user makes is meaningful.