feat(code): add "always allow" to project MCP approval prompt by mdrxy · Pull Request #4562 · langchain-ai/deepagents

Mason Daugherty (mdrxy) · 2026-07-08T14:37:40Z

The project MCP server approval prompt now offers an "always allow" option that saves approved servers to config.toml, with an all/custom/none picker so you choose exactly which servers to persist.

The project-level MCP server approval prompt (dcode startup) only offered per-session, fingerprint-based trust. This adds an "always allow" choice (a/always) that persists approved servers to [mcp].enabled_project_servers in the user-level config.toml, so they load by name on future runs without re-prompting — even if the config content changes.

Rather than presuming the whole list, "always allow" now lets you choose which servers to save via an [a]ll / [c]ustom / [n]one menu. custom reprints the servers numbered and accepts a 1,3-style selection; a single prompted server skips the menu. The writer only ever touches the user's home config.toml (never a repo file), preserving the boundary that a committed .mcp.json can't self-approve.

⚠️ Breaking change (migration)

This branch evolved past the original design above. As shipped, "always allow" persists fingerprint-scoped approvals under [mcp].enabled_project_server_approvals (bound to project root + server-definition fingerprint, so a changed command/URL re-prompts) via an arrow-key checkbox picker — not the flat, name-based [mcp].enabled_project_servers list or the all/custom/none text menu described above.

Consequences for anyone who adopted the previous per-server trust feature ([mcp].enabled_project_servers, shipped in 0.1.33/0.1.34):

The legacy [mcp].enabled_project_servers TOML key is now ignored (a debug-only log warns; the key is preserved on write, not deleted).
The env override DEEPAGENTS_CODE_ENABLED_PROJECT_MCP_SERVERS is renamed to DEEPAGENTS_CODE_DANGEROUSLY_ENABLE_PROJECT_MCP_SERVERS (still name-based and project-agnostic — the explicit escape hatch).
Interactive dcode: affected servers move back to the approval prompt; re-approve once with a. Safe, mildly annoying.
Non-interactive / dcode mcp login: affected servers silently stop loading (no prompt in these surfaces). Re-run dcode in the project to persist a scoped approval, or set DEEPAGENTS_CODE_DANGEROUSLY_ENABLE_PROJECT_MCP_SERVERS to keep the old name-based behavior.

This is fail-closed (no server loads with less scrutiny than before), so it is a safety-preserving break.

Made by Open SWE

The project-level MCP approval prompt only offered per-session (fingerprint) trust. Add an "always allow" choice that persists the prompted server names to `[mcp].enabled_project_servers` in the user-level config.toml, so they load by name on future runs without re-prompting. Writing stays in the user's home config, preserving the existing trust boundary that a repo `.mcp.json` cannot self-approve. Co-authored-by: open-swe[bot] <open-swe@users.noreply.github.com>

The "always allow" path persisted the full prompted list. Add an all/custom/ none selection so the user picks which project MCP servers to save to `[mcp].enabled_project_servers` in config.toml. "custom" reprints the servers numbered and accepts a `1,3`-style selection; a single server skips the menu. Co-authored-by: open-swe[bot] <open-swe@users.noreply.github.com>

corridor-security

The 'always allow' MCP approval flow persists trust by server name only (not by fingerprint), meaning a later change to a same-named server's command/args/env/URL in the project's .mcp.json will be auto-approved on the next run without re-prompting. This is a real design gap that enables a supply-chain-style privilege escalation for any attacker who can commit to the repo after initial approval.

corridor-security

The new 'always allow' flow persists MCP server trust by name only (not fingerprint or project scope), allowing a malicious repo with a matching server name to silently auto-execute arbitrary stdio commands without re-prompting the user.

open-swe

Open SWE Review found 1 potential issue.

Open in Web • View Open SWE trace

open-swe

Open SWE Review found 2 potential issues.

Open in Web • View Open SWE trace

…llow # Conflicts: # libs/code/tests/unit_tests/test_model_config.py

> [!CAUTION] > Merging this PR will automatically publish to **PyPI** and create a **GitHub release**. For the full release process, see [`.github/RELEASING.md`](https://github.com/langchain-ai/deepagents/blob/main/.github/RELEASING.md). --- _Release notes preview: keep this section in sync with the package `CHANGELOG.md`. The published GitHub release body is extracted from the merged `CHANGELOG.md` by `release.yml`, not from this PR description._ --- ## [0.1.40](deepagents-code==0.1.39...deepagents-code==0.1.40) (2026-07-16) ### Features - Added plugin marketplace support ([#4554](#4554)). - Added an “always allow” option to the project MCP approval prompt ([#4562](#4562)). - Improved `/goal` workflows: criteria generation now runs server-side, YOLO mode auto-accepts criteria, goals complete after satisfied grading, and goal review editing now supports `Ctrl+X` ([#4754](#4754), [#4784](#4784), [#4781](#4781), [#4780](#4780)). - Reasoning effort now persists across restarts ([#4728](#4728)). - Added a toast prompting you to re-paste when a chat paste collapses ([#4742](#4742)). ### Bug Fixes - Tool calls awaiting approval are now surfaced correctly ([#4739](#4739)). - Fixed transcript tail hydration when scrolled to the bottom edge ([#4733](#4733)). - Kept chat input responsive during MCP viewer `Ctrl+R` reconnects ([#4753](#4753)). - Improved inline free-text prompts by sharing paste handling and matching primary-input `Ctrl+D` behavior ([#4736](#4736), [#4729](#4729)). - Fixed local offloaded tool results to use the real filesystem ([#4740](#4740)). - Cleaned offloaded history when deleting a thread ([#4751](#4751)). - Removed duplicated content from the system prompt by overwriting the base prompt ([#4516](#4516)). - Closed subprocess transport during install teardown ([#4735](#4735)). - Added targeted `uv` constraints for prerelease dependencies ([#4744](#4744)). _End release notes preview._ --- > [!NOTE] > A **New Contributors** section is appended to the GitHub release notes automatically at publish time (see [Release Pipeline](https://github.com/langchain-ai/deepagents/blob/main/.github/RELEASING.md#release-pipeline), step 2). --------- Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com> Co-authored-by: langchain-oss-automated-triage[bot] <248757908+langchain-oss-automated-triage[bot]@users.noreply.github.com>

Deep Agents Code 0.1.40 replaced persisted whole-project MCP trust with selective approvals scoped to the project root, server name, and server-definition fingerprint. The documentation still described the removed `mcp_trust.json` store and treated project trust as stdio-only, which could lead users to stale configuration and cleanup steps. This update explains the allow-once and saved-approval flows, the allow and deny precedence rules, the restrictions on project `.env` files, and the migration from the legacy TOML key and environment variable. It also corrects the MCP login option to `--mcp-config` and aligns the CLI reference with remote-server trust gating. ## Type of change **Type:** Update existing documentation ## Related issues/PRs - Feature PR: langchain-ai/deepagents#4562 ## Checklist - [x] I have read the [contributing guidelines](README.md), including the [language policy](https://docs.langchain.com/oss/python/contributing/overview#language-policy) - [ ] I have tested my changes locally using `docs dev` - [x] All code examples have been tested and work correctly - [x] I have used **root relative** paths for internal links - [x] I have updated navigation in `src/docs.json` if needed

…ain-ai#4562) The project MCP server approval prompt now offers an "always allow" option that saves approved servers to `config.toml`, with an all/custom/none picker so you choose exactly which servers to persist. --- The project-level MCP server approval prompt (`dcode` startup) only offered per-session, fingerprint-based trust. This adds an "always allow" choice (`a`/`always`) that persists approved servers to `[mcp].enabled_project_servers` in the user-level `config.toml`, so they load by name on future runs without re-prompting — even if the config content changes. Rather than presuming the whole list, "always allow" now lets you choose *which* servers to save via an `[a]ll / [c]ustom / [n]one` menu. `custom` reprints the servers numbered and accepts a `1,3`-style selection; a single prompted server skips the menu. The writer only ever touches the user's home `config.toml` (never a repo file), preserving the boundary that a committed `.mcp.json` can't self-approve. --- ## ⚠️ Breaking change (migration) This branch evolved past the original design above. As shipped, "always allow" persists **fingerprint-scoped** approvals under `[mcp].enabled_project_server_approvals` (bound to project root + server-definition fingerprint, so a changed command/URL re-prompts) via an arrow-key checkbox picker — not the flat, name-based `[mcp].enabled_project_servers` list or the `all/custom/none` text menu described above. Consequences for anyone who adopted the previous per-server trust feature (`[mcp].enabled_project_servers`, shipped in `0.1.33`/`0.1.34`): - The legacy `[mcp].enabled_project_servers` TOML key is now **ignored** (a debug-only log warns; the key is preserved on write, not deleted). - The env override `DEEPAGENTS_CODE_ENABLED_PROJECT_MCP_SERVERS` is renamed to `DEEPAGENTS_CODE_DANGEROUSLY_ENABLE_PROJECT_MCP_SERVERS` (still name-based and project-agnostic — the explicit escape hatch). - **Interactive `dcode`:** affected servers move back to the approval prompt; re-approve once with `a`. Safe, mildly annoying. - **Non-interactive / `dcode mcp login`:** affected servers silently stop loading (no prompt in these surfaces). Re-run `dcode` in the project to persist a scoped approval, or set `DEEPAGENTS_CODE_DANGEROUSLY_ENABLE_PROJECT_MCP_SERVERS` to keep the old name-based behavior. This is fail-closed (no server loads with *less* scrutiny than before), so it is a safety-preserving break. Made by [Open SWE](https://openswe.vercel.app/agents/6cb9d698-5a31-5568-306a-9ff7a3f4356b) --------- Co-authored-by: open-swe[bot] <open-swe@users.noreply.github.com>

> [!CAUTION] > Merging this PR will automatically publish to **PyPI** and create a **GitHub release**. For the full release process, see [`.github/RELEASING.md`](https://github.com/langchain-ai/deepagents/blob/main/.github/RELEASING.md). --- _Release notes preview: keep this section in sync with the package `CHANGELOG.md`. The published GitHub release body is extracted from the merged `CHANGELOG.md` by `release.yml`, not from this PR description._ --- ## [0.1.40](langchain-ai/deepagents@deepagents-code==0.1.39...deepagents-code==0.1.40) (2026-07-16) ### Features - Added plugin marketplace support ([langchain-ai#4554](langchain-ai#4554)). - Added an “always allow” option to the project MCP approval prompt ([langchain-ai#4562](langchain-ai#4562)). - Improved `/goal` workflows: criteria generation now runs server-side, YOLO mode auto-accepts criteria, goals complete after satisfied grading, and goal review editing now supports `Ctrl+X` ([langchain-ai#4754](langchain-ai#4754), [langchain-ai#4784](langchain-ai#4784), [langchain-ai#4781](langchain-ai#4781), [langchain-ai#4780](langchain-ai#4780)). - Reasoning effort now persists across restarts ([langchain-ai#4728](langchain-ai#4728)). - Added a toast prompting you to re-paste when a chat paste collapses ([langchain-ai#4742](langchain-ai#4742)). ### Bug Fixes - Tool calls awaiting approval are now surfaced correctly ([langchain-ai#4739](langchain-ai#4739)). - Fixed transcript tail hydration when scrolled to the bottom edge ([langchain-ai#4733](langchain-ai#4733)). - Kept chat input responsive during MCP viewer `Ctrl+R` reconnects ([langchain-ai#4753](langchain-ai#4753)). - Improved inline free-text prompts by sharing paste handling and matching primary-input `Ctrl+D` behavior ([langchain-ai#4736](langchain-ai#4736), [langchain-ai#4729](langchain-ai#4729)). - Fixed local offloaded tool results to use the real filesystem ([langchain-ai#4740](langchain-ai#4740)). - Cleaned offloaded history when deleting a thread ([langchain-ai#4751](langchain-ai#4751)). - Removed duplicated content from the system prompt by overwriting the base prompt ([langchain-ai#4516](langchain-ai#4516)). - Closed subprocess transport during install teardown ([langchain-ai#4735](langchain-ai#4735)). - Added targeted `uv` constraints for prerelease dependencies ([langchain-ai#4744](langchain-ai#4744)). _End release notes preview._ --- > [!NOTE] > A **New Contributors** section is appended to the GitHub release notes automatically at publish time (see [Release Pipeline](https://github.com/langchain-ai/deepagents/blob/main/.github/RELEASING.md#release-pipeline), step 2). --------- Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com> Co-authored-by: langchain-oss-automated-triage[bot] <248757908+langchain-oss-automated-triage[bot]@users.noreply.github.com>

github-actions Bot added dcode Related to `deepagents-code` feature New feature/enhancement or request for one internal User is a member of the `langchain-ai` GitHub organization open-swe size: M 200-499 LOC labels Jul 8, 2026

Mason Daugherty (mdrxy) marked this pull request as ready for review July 8, 2026 20:22

Merge branch 'main' into open-swe/mcp-always-allow

53c2066

github-actions Bot added size: L 500-999 LOC and removed size: M 200-499 LOC labels Jul 8, 2026

corridor-security Bot reviewed Jul 8, 2026

View reviewed changes

Comment thread libs/code/deepagents_code/main.py Outdated

cr

fbe05eb

corridor-security Bot reviewed Jul 9, 2026

View reviewed changes

Comment thread libs/code/deepagents_code/main.py

cr

4048278

github-actions Bot added size: XL 1000+ LOC and removed size: L 500-999 LOC labels Jul 9, 2026

open-swe Bot reviewed Jul 9, 2026

View reviewed changes

Comment thread libs/code/deepagents_code/mcp_login_service.py Outdated

cr

17f6ed3

open-swe Bot reviewed Jul 9, 2026

View reviewed changes

Comment thread libs/code/deepagents_code/mcp_login_service.py

Comment thread libs/code/deepagents_code/model_config.py Outdated

Mason Daugherty (mdrxy) and others added 9 commits July 9, 2026 00:01

cr

e032a23

cr

cc3d97e

cr

dd39ce8

cr

f2085e8

resolve conflicts

3e15ad2

cr

df138c4

merge

1cfcc5e

merge

a83af62

Merge branch 'main' into open-swe/mcp-always-allow

7f40cea

Mason Daugherty (mdrxy) and others added 16 commits July 14, 2026 01:25

cr

65d60b8

cr

5a38d49

cr

497adfe

Merge branch 'main' into open-swe/mcp-always-allow

0a8e888

cr

5b9036a

cr

ccdda9e

cr

e78244b

Merge remote-tracking branch 'origin/main' into open-swe/mcp-always-a…

58cbda0

…llow # Conflicts: # libs/code/tests/unit_tests/test_model_config.py

cr

bbc18cc

cr

38acc16

Merge branch 'main' into open-swe/mcp-always-allow

f2ba09a

Merge branch 'main' into open-swe/mcp-always-allow

669c95e

fix tests

138d387

merge

d2690dd

cr

b3d45e6

cr

867bd17

Mason Daugherty (mdrxy) merged commit ffab82a into main Jul 15, 2026
51 checks passed

Mason Daugherty (mdrxy) deleted the open-swe/mcp-always-allow branch July 15, 2026 14:06

github-actions Bot mentioned this pull request Jul 15, 2026

release(deepagents-code): 0.1.40 #4734

Merged

Mason Daugherty (mdrxy) mentioned this pull request Jul 20, 2026

docs(code): document saved project MCP approvals langchain-ai/docs#4990

Merged

5 tasks

Navigation Menu

Uh oh!

feat(code): add "always allow" to project MCP approval prompt - #4562

feat(code): add "always allow" to project MCP approval prompt#4562
Mason Daugherty (mdrxy) merged 31 commits into
mainfrom
open-swe/mcp-always-allow

Mason Daugherty (mdrxy) commented Jul 8, 2026 •

edited

Loading

Uh oh!

corridor-security Bot left a comment

Uh oh!

Uh oh!

corridor-security Bot left a comment

Uh oh!

Uh oh!

open-swe Bot left a comment

Uh oh!

Uh oh!

open-swe Bot left a comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Uh oh!

Conversation

Mason Daugherty (mdrxy) commented Jul 8, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

⚠️ Breaking change (migration)

Uh oh!

corridor-security Bot left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

corridor-security Bot left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

open-swe Bot left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

open-swe Bot left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Mason Daugherty (mdrxy) commented Jul 8, 2026 •

edited

Loading