Add security settings for MCP servers

[h8ghbzc9bbr8c7]

I understand that MCP servers should ensure security (allowed path, reading/writing allowness) on their own. But IMHO it would be helpful when askimo would - as a kind of double border - allow to set for an added MCP server what operations are allowed (read, write). I am not sure whether this belongs in an harness but I would expect such a setting.

[haiphucnguyen]

Thanks for the suggestion! We've actually been thinking about this too, and there's already some groundwork in place. When you load the available tools for an MCP server, we classify each tool based on its description - distinguishing read vs. write operations. We also had an early implementation of a per-tool approval mode where the user could choose whether the AI executes an operation automatically or requires explicit confirmation first, but we put it on hold while we worked through some open questions.

So we're about halfway there. If I understand correctly, the missing piece is the ability to configure per-tool execution behavior - letting users decide whether a specific tool runs automatically or requires explicit approval before the AI proceeds. That's not something we've implemented yet. Given our current priorities it's unlikely to land in the near term, but it's a worthwhile improvement. I'll convert this to a GitHub issue so any contributor who wants to pick it up can do so.

[haiphucnguyen]

I started drafting the GitHub issue for this request, but it quickly became clear that contributors would struggle to complete it in that form. Instead, I spun up a draft feature branch based on my ticket. Take a look here:
askimo-ai/askimo – support‑tools‑approval

The idea for this improvement is that we let the user can control what tool the AI can execute automatically and what tool need the human approve

Let me know if it works. Thank you!

[haiphucnguyen]

Hi @h8ghbzc9bbr8c7 , I merged this branch to the main branch. Let me know if it works for you.

[h8ghbzc9bbr8c7]

Thanks, this works and is really helpful! I had something different in my mind which may result from my limitted search for or understanding of MPT servers. I understand that common open-sourve MTP servers allow to specify a directory under which they work. This is one security border. But to fulfil this and for operations within this directory I have to trust the MTP-Server and its security implementation.

What I meant was a second security border insider of Askimo: When adding a MTP server I meant adding a list of radio buttons which select which operations (read, write, create) Askimo will send to the MPT-Server.

For example: I add a filesystem MTP-Server and enable in Askimo only "read". Then I would expect that Askimo itself does not even pass a write request to the server.

But maybe this is overkill...

Thanks again, I really like Askimo!

[haiphucnguyen]

Thanks for the kind words, and that's a great clarification! Yeah, it requires the workflow a bit complicated, and we can consider it in the future.

In this thread discussion, I have an idea for MCP configuration not relate to your original security ideas but relates to tool selection, so we can count your contribution :)

• We should have an option to let user control what tools send to MCP

Currently, Askimo pulls the entire list of tools from the MCP servers, and whenever a user triggers a tool send, every available tool is forwarded to the AI. This blanket approach becomes unwieldy when the toolset grows large. Allowing users to select the specific tools they want to use - via the MCP server interface - would make the system more efficient and user‑friendly.

I am going to write the follow up ticket since it is as a good first issue.

Thanks again, I really like Askimo!

Thank you, that really means a lot! 😊 If you're enjoying Askimo, sharing it with your network would help us reach more people. We'd really appreciate it! 🙏