Approval for new MCP servers

Turn on Require approval for new MCP servers when you want unknown servers held back until someone has looked at them.

How it behaves

A server nobody has reviewed — meaning it has no explicit per-server rule on MCP Inventory — is enforced at the pending action you choose, instead of the MCP default action. Setting any explicit rule for that server counts as reviewing it, and takes over from the pending action immediately.

So the workflow is:

1. A developer starts using a new MCP server.
2. It appears in MCP Inventory with a Pending approval badge.
3. Until you set a rule, it's held at the pending action (typically block or warn).
4. You set allow, warn, report or block — and the badge disappears.

Why this exists

The MCP ecosystem is young and unvetted; a server added on Tuesday can do anything its tools describe. This setting turns "anyone can add anything" into "anything new waits for a human", without blocking the servers your team already relies on.