feat: add fine-grained auto-approval for servers and tools

- Add autoApprove config field (boolean or string array)
- Support server-level and tool-specific auto-approval
- Add 'a' keymap to toggle auto-approval in UI
- Show visual indicators for auto-approval status
- Resources are always auto-approved by default

Author: ravitemer

lua/mcphub/extensions/avante.lua

@@ -71,15 +71,10 @@ function M.mcp_tool()
                 if #params.errors > 0 then
                     return on_complete(nil, table.concat(params.errors, "\n"))
                 end
-                local auto_approve = vim.g.mcphub_auto_approve == true
+                -- Check both global and server-specific auto-approval
+                local auto_approve = vim.g.mcphub_auto_approve == true or params.should_auto_approve
                 if not auto_approve then
-                    local confirmed = shared.show_mcp_tool_prompt({
-                        action = params.action,
-                        server_name = params.server_name,
-                        tool_name = params.tool_name,
-                        uri = params.uri,
-                        arguments = params.arguments,
-                    })
+                    local confirmed = shared.show_mcp_tool_prompt(params)
                     if not confirmed then
                         return on_complete(nil, "User cancelled the operation")
                     end

lua/mcphub/extensions/codecompanion/utils.lua

@@ -18,7 +18,9 @@ function M.create_handler(action_name, has_function_calling, opts)
                 })
             end
 
-            local auto_approve = (vim.g.mcphub_auto_approve == true) or (vim.g.codecompanion_auto_tool_mode == true)
+            local auto_approve = (vim.g.mcphub_auto_approve == true)
+                or (vim.g.codecompanion_auto_tool_mode == true)
+                or params.should_auto_approve
             if not auto_approve then
                 local confirmed = shared.show_mcp_tool_prompt(params)
                 if not confirmed then

lua/mcphub/extensions/shared.lua

@@ -3,7 +3,52 @@ local NuiLine = require("mcphub.utils.nuiline")
 local Text = require("mcphub.utils.text")
 local ui_utils = require("mcphub.utils.ui")
 
----@alias MCPCallParams {errors: string[], action: MCPHubToolType, server_name: string, tool_name: string, uri: string, arguments: table}
+---@alias MCPCallParams {errors: string[], action: MCPHubToolType, server_name: string, tool_name: string, uri: string, arguments: table, should_auto_approve: boolean}
+
+---Check if auto-approval is enabled for a specific tool/resource
+---@param server_name string
+---@param tool_name? string Tool name for tool calls (nil for resources)
+---@return boolean
+local function should_auto_approve(server_name, tool_name)
+    -- Global auto-approve check
+    if vim.g.mcphub_auto_approve == true then
+        return true
+    end
+
+    -- Get server config
+    local State = require("mcphub.state")
+    local native = require("mcphub.native")
+
+    local is_native = native.is_native_server(server_name)
+    local server_config = is_native and State.native_servers_config[server_name] or State.servers_config[server_name]
+
+    if not server_config then
+        return false
+    end
+
+    local auto_approve = server_config.autoApprove
+    if not auto_approve then
+        return false
+    end
+
+    -- If autoApprove is true, approve everything for this server
+    if auto_approve == true then
+        return true
+    end
+
+    -- If autoApprove is an array, check if tool is in the list
+    if type(auto_approve) == "table" and vim.islist(auto_approve) then
+        -- For resources, always auto-approve (no explicit config needed)
+        if not tool_name then
+            return true
+        end
+
+        -- For tools, check if the specific tool is in the list
+        return vim.tbl_contains(auto_approve, tool_name)
+    end
+
+    return false
+end
 
 ---@param params {server_name: string, tool_name: string, uri: string, tool_input: table | string}
 ---@param action_name MCPHubToolType
@@ -40,13 +85,19 @@ function M.parse_params(params, action_name)
     if action_name == "access_mcp_resource" and not uri then
         table.insert(errors, "uri is required")
     end
+
+    -- Check auto-approval based on server config and tool/resource
+    local should_auto_approve_result =
+        should_auto_approve(server_name, action_name == "use_mcp_tool" and tool_name or nil)
+
     return {
         errors = errors,
         action = action_name or "nil",
         server_name = server_name or "nil",
         tool_name = tool_name or "nil",
         uri = uri or "nil",
         arguments = arguments or {},
+        should_auto_approve = should_auto_approve_result,
     }
 end
 
@@ -251,6 +302,11 @@ end
 ---@param params MCPCallParams
 ---@return boolean, boolean
 function M.show_mcp_tool_prompt(params)
+    -- Check if we should auto-approve based on server/tool config
+    if params.should_auto_approve then
+        return true, false -- approved, not cancelled
+    end
+
     local action_name = params.action
     local server_name = params.server_name
     local tool_name = params.tool_name

lua/mcphub/types.lua

@@ -28,6 +28,7 @@
 ---@field disabled_resources? string[]
 ---@field disabled_resourceTemplates? string[]
 ---@field custom_instructions? CustomMCPServerConfig.CustomInstructions
+---@field autoApprove? boolean|string[] -- true for all tools, array of tool names for specific tools
 
 ---@class MCPServerConfig: CustomMCPServerConfig
 ---@field command? string

lua/mcphub/ui/views/main.lua

@@ -453,6 +453,12 @@ function MainView:setup_active_mode()
                 end,
                 desc = "Toggle",
             },
+            ["a"] = {
+                action = function()
+                    self:handle_auto_approve_toggle()
+                end,
+                desc = "Auto-approve",
+            },
             ["h"] = {
                 action = function()
                     self:handle_collapse()
@@ -483,6 +489,137 @@ function MainView:setup_active_mode()
     self:apply_keymaps()
 end
 
+-- Helper function to get all tool names for a server
+local function get_server_tool_names(server_name)
+    local tools = {}
+
+    -- Check if it's a native server
+    local is_native = native.is_native_server(server_name)
+    if is_native then
+        local native_server = is_native
+        for _, tool in ipairs(native_server.capabilities.tools or {}) do
+            table.insert(tools, tool.name)
+        end
+    else
+        -- Regular MCP server
+        for _, server in ipairs(State.server_state.servers) do
+            if server.name == server_name and server.capabilities then
+                for _, tool in ipairs(server.capabilities.tools or {}) do
+                    table.insert(tools, tool.name)
+                end
+                break
+            end
+        end
+    end
+
+    return tools
+end
+
+-- Helper function to determine actual auto-approval status
+local function get_auto_approval_status(server_config, all_tools)
+    local auto_approve = server_config.autoApprove
+
+    if auto_approve == true then
+        return "all", #all_tools -- All tools auto-approved
+    elseif type(auto_approve) == "table" and vim.islist(auto_approve) then
+        if #auto_approve == 0 then
+            return "none", 0
+        elseif #auto_approve == #all_tools then
+            return "all", #all_tools -- All tools are in the list
+        else
+            return "partial", #auto_approve -- Some tools auto-approved
+        end
+    else
+        return "none", 0 -- No auto-approval
+    end
+end
+
+function MainView:handle_auto_approve_toggle()
+    -- Get current line
+    local cursor = vim.api.nvim_win_get_cursor(0)
+    local line = cursor[1]
+
+    -- Get line info
+    local type, context = self:get_line_info(line)
+    if not type or not context or not State.hub_instance then
+        return
+    end
+
+    if type == "server" then
+        -- Check if server is enabled
+        if context.status == "disabled" or context.status == "disconnected" then
+            return
+        end
+
+        -- Toggle auto-approval for entire server
+        local server_name = context.name
+        local is_native = native.is_native_server(server_name)
+        local server_config = (
+            is_native and State.native_servers_config[server_name] or State.servers_config[server_name]
+        ) or {}
+
+        local all_tools = get_server_tool_names(server_name)
+        local status, _ = get_auto_approval_status(server_config, all_tools)
+        local new_auto_approve
+
+        if status == "all" then
+            -- Currently auto-approving all tools, turn off
+            new_auto_approve = {}
+        else
+            -- Currently partial or no auto-approval, enable for all
+            new_auto_approve = vim.deepcopy(all_tools)
+        end
+
+        State.hub_instance:update_server_config(server_name, {
+            autoApprove = new_auto_approve,
+        })
+    elseif type == "tool" and context then
+        -- Check if tool is enabled
+        if context.disabled then
+            return
+        end
+
+        -- Toggle auto-approval for specific tool
+        local server_name = context.server_name
+        local tool_name = context.def.name
+        local is_native = native.is_native_server(server_name)
+        local server_config = (
+            is_native and State.native_servers_config[server_name] or State.servers_config[server_name]
+        ) or {}
+
+        local current_auto_approve = server_config.autoApprove or {}
+        local new_auto_approve
+
+        -- Handle boolean case (convert to array first)
+        if current_auto_approve == true then
+            local all_tools = get_server_tool_names(server_name)
+            current_auto_approve = vim.deepcopy(all_tools)
+        end
+
+        -- Ensure it's an array
+        if not vim.islist(current_auto_approve) then
+            current_auto_approve = {}
+        end
+
+        -- Toggle the tool in the list using filter instead of table.remove
+        local tool_approved = vim.tbl_contains(current_auto_approve, tool_name)
+
+        if tool_approved then
+            -- Remove tool from auto-approve list
+            new_auto_approve = vim.tbl_filter(function(tool)
+                return tool ~= tool_name
+            end, current_auto_approve)
+        else
+            -- Add tool to auto-approve list
+            new_auto_approve = vim.deepcopy(current_auto_approve)
+            table.insert(new_auto_approve, tool_name)
+        end
+
+        State.hub_instance:update_server_config(server_name, {
+            autoApprove = new_auto_approve,
+        })
+    end
+end
 function MainView:handle_server_toggle()
     -- Get current line
     local cursor = vim.api.nvim_win_get_cursor(0)