Most MCP destructive tools and hosts leave deletions unapproved by default

Human-in-the-loop on paper is still a missing if on both ends of MCP.

Around 2 November 2026, Junwei Yao, Zike Yang, Zhijun Wang, Yongxi Zhou, and Wenbo Ye posted arXiv:2611.02527 with a paired measurement: how registry servers confirm destructive tools, and how popular hosts behave by default when those tools fire.

Servers skip confirmation; hosts skip prompts; injections delete anyway

The MCP specification says there SHOULD always be a human who can deny tool invocations, then splits the mechanism. Servers may annotate tools or elicit through the host. Hosts decide whether to prompt. Neither side is forced.

On the server side, a weighted read of a 1,000-repository official-registry sample estimates that 90% of destructive tools (95% CI 82–95) have no server-side confirmation. Most servers that do elicit still proceed, or fall back to a flag the model can set, when the host cannot relay the question.

On the host side, 32 of 41 surveyed open-source hosts and agent SDKs have no approval step by default, including 16 of 25 applications. Pairing sampled destructive tools with those applications, 60.7% of pairs have no enforced human approval under defaults.

Live injection runs make the abstract concrete. Through four agent SDKs, four of five low-cost models executed an injected deletion in 479 of 960 runs. On an annotation-only stub server, every attempted injected deletion succeeded (180 of 180 attempts). Counterfactuals are sharp: if hosts prompted for every tool not annotated read-only or non-destructive, the unapproved share of the paired set would fall to 5.4%. Universal elicitation support would still leave 56.7%.

“SHOULD” met a fleet that ships approval off

Coding agents and chat hosts normalised MCP while treating confirmation as someone else’s problem. Server authors disabled their own prompts because “clients gate destructive calls.” Client authors shipped SDKs with approval hooks off. The paper lands as that mutual shrug becomes measurable.

It also sits beside I-HITL’s OTP-wallet result without repeating it: different topology, same lesson that a human gate written into a policy document is not the same as a blocking prompt on the call path.

Source-traced hosts, weighted registry estimate, injection suite

Paper: arXiv:2611.02527, independent authors, posted early November 2026. Method mixes static coding of pinned repositories, dual-LLM adjudication with human audit on a subsample, and live stub-server runs. Maturity: measurement study usable for governance checklists; not a packaged product. Reproduce by re-coding your own host defaults and sampling the servers you actually install.

Configure host approval before trusting server annotations

Application developers should turn on SDK approval options or pre-call hooks now. The tools you attach rarely supply a fail-closed human gate, and every SDK in the cohort ships approval off. Host maintainers aiming for a single high-leverage change should prompt on tools that are not annotated read-only or non-destructive.

Server authors who need confirmation should refuse when the host cannot elicit, or return a preview without acting. Annotations and model-settable confirm flags inform a cooperative stack; they do not create a human decision by themselves.

Fail-open elicitation and model-owned flags recreate the hole

A server that elicits and then proceeds when the host is silent still deletes on the 26 hosts that never show elicitation UI. A confirm=true argument the model can set is not a human gate; injection runs show models setting it even when the planted text never names the flag.

Extractor coverage is incomplete by the authors’ own audit, so the 90% figure is an estimate with wide intervals on some tiers. Headless CI agents that cannot prompt will need an explicit deny-by-default policy, or they will look “fixed” in interactive demos and open in automation.

Make the host the default approver until servers fail closed

The Monday move is to flip host defaults: prompt on non-read-only MCP tools, refuse fail-open elicitation, and stop counting destructiveHint as proof that a person saw the call. Server confirmation remains useful; without a prompting host it rarely reaches a human.