What UX patterns help users make informed MCP approval decisions without approval fatigue?

Attempt it

Describe UX patterns that help users make informed MCP tool approval decisions while avoiding approval fatigue.

Free · 2 AI evals / day

Quick reference

TL;DR

Show users the full tool definition the model sees, scope and tier approvals to fight fatigue, and flag changes; the consent UX is a security control against tool poisoning.

Memory aid

Sign in for the mnemonic that makes this stick. See Pro pricing.

Easy to grasp

Picture signing for a package at your door. A bad delivery UX makes you scribble your name on every box without reading anything, so you'd sign for a bomb just as fast as a birthday card. A good UX shows you what's inside, who sent it, and only stops you for the suspicious ones. MCP approval is the same. If the app makes you click 'allow' a hundred times, you stop reading and approve everything, including a poisoned tool whose hidden instructions tell the model to leak your files. Good approval UX shows the real tool description the model sees, groups the safe reads, and flags anything that changed since you last trusted it.

Key concepts

Tool poisoning Approval fatigue Informed consent UX Rug pull attack

Quick scan · 2–4 min

Everything important, quickly.

5 min: why fatigue breaks consent + show the full description the model sees + risk tiering + provenance + definition pinning against rug pulls + frame UX as a security control.

Side-by-side

Pattern	Anti-pattern (fails)	Better pattern (informed consent)
What is shown	Tool name only	Full description the model sees, plus data-flow summary
Granularity	Blanket allow-all per server	Risk-tiered, session or path scoped grants
Read-only tools	Prompt on every call	Batch-approve to cut fatigue
Destructive tools	Same flow as reads	Individual prompt every time
Definition changes	Silently honored	Re-prompt and diff against the approved hash

Real-world examples

Real products, models, and research that use this idea.

Claude Desktop and Claude Code prompt for tool approval per server and let users scope grants rather than blanket-trusting a server.
The OWASP MCP Top 10, published in 2025, lists tool poisoning and rug pull attacks that informed-consent UX is designed to mitigate.
Cursor and Zed surface MCP server origin from the config file so users can judge provenance before approving tools.
Invariant Labs' 2025 tool poisoning disclosure showed hidden instructions in a server's tool description steering the model to exfiltrate files.

Interviewer follow-ups

What an interviewer would ask next. Try answering before peeking at the approach.

QHow would you detect a rug pull where a server swaps a benign tool for a malicious one after approval?

Sign in or go Pro to see the approach for this follow-up.

QHow do you stop hidden instructions in a tool description from reaching the user as trusted text?

Sign in or go Pro to see the approach for this follow-up.

QWhere do you draw the line between batch-approving and individually prompting a tool?

Sign in or go Pro to see the approach for this follow-up.

QHow does approval fatigue itself become an attack surface an adversary can exploit?

Sign in or go Pro to see the approach for this follow-up.

60-second cheat sheet

The night-before-the-interview bullets. Scan these on the way to the call.

Sign in for 5 unlocks/day or go Pro for unlimited revision sheets. See Pro pricing.

References

Primary sources. Skim if you want the original framing.