feat(frontend): per-server Auto-approve tool changes toggle (MCP-2932)#725
Merged
Conversation
Deploying mcpproxy-docs with
|
| Latest commit: |
54b084b
|
| Status: | ✅ Deploy successful! |
| Preview URL: | https://4150ce74.mcpproxy-docs.pages.dev |
| Branch Preview URL: | https://feat-mcp-2932-auto-approve-t.mcpproxy-docs.pages.dev |
|
Codecov Report✅ All modified and coverable lines are covered by tests. 📢 Thoughts on this report? Let us know! |
📦 Build ArtifactsWorkflow Run: View Run Available Artifacts
How to DownloadOption 1: GitHub Web UI (easiest)
Option 2: GitHub CLI gh run download 27823465874 --repo smart-mcp-proxy/mcpproxy-go
|
Dumbris
added a commit
that referenced
this pull request
Jun 19, 2026
…API (MCP-2940) (#727) MCP-2930 (#724) added the per-server auto_approve_tool_changes flag to config.ServerConfig but did not extend the REST layer, so the Web UI toggle (MCP-2932, PR #725) could neither read nor persist it. REST request side: - Add AutoApproveToolChanges *bool to httpapi.AddServerRequest. - Wire it into handleAddServer (create) and handlePatchServer with *bool nil-preserve semantics: omitting it on PATCH preserves the existing pointer (which may be nil = "never set"); an explicit value (including false) is applied. server.UpdateServer applies the pointer only when non-nil so callers that don't touch it (e.g. config-to-secret) never reset it. REST read side: - Add AutoApproveToolChanges *bool to contracts.Server (omitempty → tri-state nil stays out of the payload so the UI can tell unset from explicit false). - Emit auto_approve_tool_changes from runtime.GetAllServers (StateView path) and getAllServersLegacy, in parity with quarantined. - Project it in management.ListServers and ConvertGenericServersToTyped / ConvertServerConfig. Persistence: - SaveConfiguration rebuilds the JSON config's server list from BBolt records, so a field absent from storage.UpstreamRecord is wiped on the next mutation. Add AutoApproveToolChanges to UpstreamRecord and all four selective conversions (Save/Get/List in manager.go, saveServerSync in async_ops.go); update TestSaveServerSyncFieldCoverage to require it in BBolt. Verified the flag now survives PATCH→GET and a full restart. Tests: handler PATCH (set/preserve-nil/preserve-true/explicit-false) + GET exposure; management + contracts projection; storage Save/Get/List round-trip incl. tri-state nil. OpenAPI regenerated. Docs updated (tool-quarantine.md, rest-api.md). Related #725. Runtime enforcement remains MCP-2931.
…2932)
Add an 'Auto-approve tool changes' toggle to the server Configuration tab,
bound to the per-server auto_approve_tool_changes flag (MCP-2930). OFF by
default (protected); a rug-pull warning hint sits directly beneath it. Toggling
persists through the existing PATCH /api/v1/servers/{id} path and surfaces a
success toast.
- types/api.ts: add optional auto_approve_tool_changes to Server (undefined = OFF)
- ServerDetail.vue: Tool-change approval card with toggle + warning + handler
- docs(tool-quarantine): document the Web UI toggle
- test: component test covering reflect/persist + warning render
Related #MCP-2916
Dumbris
force-pushed
the
feat/mcp-2932-auto-approve-tool-changes-ui
branch
from
6e71842 to
36da939
Compare
![mcpproxy-gatekeeper[bot]](https://avatars.githubusercontent.com/u/216428285?s=60&v=4){kind=small}
There was a problem hiding this comment.
Approved via Claude Code review (MCP-2932). Per-server Auto-approve tool changes toggle + rug-pull warning, OFF by default, persists via existing PATCH; functional now that MCP-2940 REST round-trip + MCP-2931 enforcement are merged. vitest 208/208, vue-tsc clean.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Adds the per-server "Auto-approve tool changes" toggle to the Web UI (MCP-2932, parent MCP-2916), bound to the
auto_approve_tool_changesconfig flag.frontend/src/views/ServerDetail.vue— Tool-change approval card in the Configuration tab: atoggle-warningcheckbox + aPATCH /api/v1/servers/{id}path (patchServerDiff) with a success toast; reverts on failure.frontend/src/types/api.ts— optionalauto_approve_tool_changes?: booleanonServer(absent/undefined = OFF; tri-state nil preserved).docs/features/tool-quarantine.md— documents the Web UI toggle (ENG-9).frontend/tests/unit/server-detail-auto-approve.spec.ts— component test: renders, reflects the server flag, persists{auto_approve_tool_changes: true|false}viaapi.patchServer, warning renders.Dependency resolved
The backend REST plumbing (MCP-2940, #727) is merged to main —
AddServerRequest/PATCH/POST accept the flag, GET server-status exposes it, and it persists to BBolt. This branch is rebased onto that main, so the toggle is fully functional end-to-end.Verification
vitest→ 218 passed (29 files), incl. 5 new MCP-2932 tests;vue-tsc --noEmitclean;make buildgreen.PATCH true→ GET reflectstrue→ persisted to config file →PATCH falseclears it → settrue+ restart → stilltrue(BBolt survival).true→false, API confirms).Related #MCP-2916 · backend #727 (MCP-2940) · runtime enforcement: MCP-2931. Per Gate 3, opened for review — the human merges on GitHub.