Letting hosts pick which MCP tools the model can use

[Shubhdeep12]

I've been wiring MCP servers into chat() and got one issue that I think others might run into too.

Right now, If I connect an MCP server, every tool it lists goes straight to the model, and every tool runs without asking.

Here's where things stand today:

• In managed mode chat({ mcp: { clients } }), I couldn't find a way to filter tools or add approval.
• In manual mode, I can .filter() the result of mcp.tools(), but then I lose the automatic discovery and cleanup that make managed mode nice.
• The server's hints (readOnlyHint, destructiveHint) already reach tool.metadata.mcp, which is great. Nothing uses them yet, though.

What I'd suggest is two small, optional settings on the client:

const github = await createMCPClient({
  transport,
  // only show the model tools the server marks as read-only
  toolFilter: (tool) => tool.annotations?.readOnlyHint === true,
  // or: keep everything, but ask before anything that isn't read-only
  needsApproval: (tool) => tool.annotations?.readOnlyHint !== true,
})

chat({ adapter, messages, mcp: { clients: [github] } })

A few points:

• Both will be off by default, so nobody's setup changes unless they opt in.
• They'd work per server in a pool too, so you can lock down GitHub and leave an internal docs server wide open.
• I know annotations are just hints from the server, and a bad server can lie. For untrusted servers, we can filter by tool.name instead, and I'd call that out clearly in the docs.

fwiw, other SDKs landed on similar designs:

• OpenAI Agents SDK has toolFilter per MCP server
• Google ADK has tool_filter
• Pydantic AI has .filtered() / .approval_required()
• and the Vercel AI SDK has a toolApproval callback.

raised a PR for the same.