Write action approval for MCP servers
Write actions change data in connected apps, such as creating a Jira issue or editing a Google Doc. The Write action approval setting on each Glean MCP server controls who asks the user to approve those actions when an MCP host runs them through run_tool: Glean or the host.
Understand how approval works
Glean applies different rules depending on how a host reaches a tool. The setting only changes the last row of this table:
| How the host calls the tool | Who approves it |
|---|---|
| A write tool you added to the server individually | The MCP host, according to its own approval settings |
A read action called through run_tool | No approval needed. Glean always allows it |
A write action called through run_tool | Depends on the Write action approval setting |
Write tools you add individually follow the host's approval settings, so they run without a prompt if a user sets the host to allow tool calls automatically.
run_tool is part of the Dynamic skills and tools managed toolset. It lets a host call connected tools on demand instead of loading them all at the start of a session. The setting has no effect on a server without run_tool, and the Admin console disables it until you add the toolset. See Dynamic skills and tools.
Choose an option
Each option handles two kinds of hosts: hosts that can show Glean's approval prompt, and hosts that can't. The options differ in how much they trust each host's own approval.
| Option | Hosts that can show Glean's prompt | Other hosts |
|---|---|---|
| Require Glean approval (default) | Glean asks the user to approve each write action | Glean blocks write actions |
| Glean asks when the host supports it | Glean asks the user to approve each write action | Write actions run with the host's own approval |
| Never ask from Glean | Write actions run with the host's own approval | Write actions run with the host's own approval |
Servers created before this setting existed keep their earlier behavior. A server that had Glean's approval prompts turned off uses Never ask from Glean. Every other server uses Require Glean approval.
Glean asks for approval through MCP elicitation, which lets a server request input from the user mid-task. Glean can show its prompt only in hosts that support elicitation as defined in the 2026-07-28 revision of the MCP specification, sometimes called MCP 2.0. Glean checks for this support when the host connects. See Elicitation in the MCP specification.
Understand why Glean asks for approval
MCP hosts design tool approval around individual tools. A user approves a tool, and the host treats later calls to that tool the same way. That works when each tool does one thing, such as a tool that only creates Jira issues.
Major hosts aren't designed for dynamic tools like run_tool, which can run any connected tool. For a run_tool call, what needs approval is less the tool itself and more its parameters: which connected tool runs and what it does in this particular call. To a host, sending a Slack message to one person and posting in a company-wide channel are the same run_tool call. Glean reads the parameters of each call, so it can ask the user to approve the specific action before it runs.
Weigh caution against capability
No option is right for every organization. Each one trades some protection for broader access to write actions, so pick the one that matches how much you trust the hosts your users connect.
- Require Glean approval is the most cautious. Glean requires its approval for every write action through
run_tool. It asks in hosts that can show its prompt and blocks write actions everywhere else, regardless of how the host is configured. Users of hosts that can't show the prompt lose write actions throughrun_tooluntil their host adds support. - Glean asks when the host supports it keeps write actions available in every host. In hosts that can't show Glean's prompt, protection depends on the host's own approval settings, which users can sometimes loosen or turn off.
- Never ask from Glean relies entirely on each host. Choose it when every host you allow already asks users to approve tool calls and you don't want users to see a second prompt from Glean. Glean asks you to confirm before it saves this option.
You also control which hosts can connect to Glean in the first place. If you restrict OAuth registration to approved applications, you know which hosts' approval behavior you're relying on, and a less cautious option carries less risk. See Dynamic Client Registration.
Prerequisites
Complete the following prerequisites:
- Have the Admin or MCP Server Moderator role to change write action approval. See MCP Server Moderator.
- Add the Dynamic skills and tools managed toolset to the server. See Create and manage MCP servers.
Change the setting
- Go to Admin console → Platform → Glean MCP servers and select the MCP servers tab.
- Click the server name to open its configuration.
- In the Write action approval section, select an option.
- If you selected Never ask from Glean, click Never ask from Glean in the confirmation dialog.
You can also choose an option when you create a server. The setting applies only to the server you change.
See also
- Human-in-the-loop confirmations for write tools — how users review and approve write tools in Glean and in the Glean plug-in
- MCP Security, Data Flow, and Permissions — how the Glean MCP server handles identity and permissions
- Host apps — the MCP hosts that connect to Glean