SW-CFG-012: MCP server configured to approve every tool call automatically

What it detects

The rule reads the servers of the MCP client files (.mcp.json, .vscode/mcp.json and .cursor/mcp.json, in any folder) and the inline servers of a plugin manifest. A server is reported for each setting that approves calls without a question: default_tools_approval_mode set to approve in any case; a tools entry whose approval_mode is approve; autoApprove or alwaysAllow as a list with at least one item; and trust set to true.

An empty list, the value prompt, a text where a list is expected and a key outside a server object are quiet. A per-tool approve and a list of tools are also quiet when every tool they name is read-only by its name: the name starts with a read verb such as get, list, read, search, find, view, show, describe, status or resize (one leading noun is allowed, as in browser_resize) and holds no word that writes, runs, sends, fetches or touches secrets. A wildcard and the server-wide settings always fire. A list cut at 64 items counts as acting. A server yields at most 20 findings, one per setting on its own line, and the evidence reads the setting, with the number of tools for a list.

Why it matters

An approval is the moment when a person sees a tool call before it has an effect. Switching it off for a server means that a poisoned tool description or an instruction hidden in a document can make the agent write files, run commands or send messages with nobody looking. The scanner maps this rule to OWASP ASI02, Tool Misuse and Exploitation, and to NIST SP 800-53 controls AC-6, Least Privilege, and CM-7, Least Functionality: approve only what is read-only and leave everything that acts to a person.

Example

The server below lists two tools that change files and run commands under autoApprove:

.mcp.json

{
  "mcpServers": {
    "files": {
      "command": "npx",
      "args": [
        "-y",
        "demo-files-mcp@1.0.0"
      ],
      "autoApprove": [
        "write_file",
        "run_command"
      ]
    }
  }
}

The evidence reads files: autoApprove = 2 tool(s) listed on the line of the list. A list holding only tools such as get_status or search_docs would stay quiet.

How to fix

Remove the setting so that the client asks again, or cut the list down to tools that only read and are safe to run unattended. Names that start with a read verb, like list_files, are accepted by the rule.

Keep server-wide approval and trust off for any server that can write, run or send, and review each tool you add to a list the way you review a new permission.

If it is a false positive

The rule reads names, not behaviour. A tool called fetch_docs only reads from a documentation site, but the word fetch reaches out to the network, so it counts as acting and the list is reported. Accept the finding with a note that says what the tool does and what it can reach.

If the finding is not a problem in your case, accept it with a note: in the dashboard a manager or owner can accept a finding and the note is kept with it; with the scanner on its own, add it to the baseline file with a reason and an expiry date.

Related rules

• SW-CFG-008: Settings switch off approval prompts
• SW-SKL-036: Frontmatter pre-approves an unscoped shell or interpreter