Every MCP server you add runs on your machine, and every update can change what it does. Here’s the routine I use now, built from what people in this group taught me. Copy it, and it takes five minutes per server. Step 0: Allow by tool name, never by server (Claude Code). mcp__myserver pre-approves everything that server will ever ship, including tools added in an update. mcp__myserver__get_post approves one tool, so a new one still asks first. (Thanks, Aurel.) Heads up: the server name in the rule is the key from your config, not the npm package name. Step 1: Pin the version in the config that starts the server, not only in your notes. "args": ["-y", "
[email protected]"], not "args": ["-y", "name"]. A config with no version can run something other than the version you approved, so everything after this step may describe the wrong thing. Step 2: Write the approval down the day you approve it. ServerVersionDateTools offered (names)Websites it reached at startupWho approved Step 3: On every new version, diff before you move up. Check for a newer version with npm view name version. Then compare the two tool lists: new or removed tools, and changed descriptions and input schemas. A name-based rule never re-prompts on those, and the model reads that text to choose a tool. My free page does this comparison in your browser: mcp.brydge-ai.com/diff.html. Paste two lists and it shows old and new text. Step 4: Keep anything new off until someone says yes. Step 5: Try the first run on fake data or a throwaway account. A diff compares what a server says about itself and what it did at startup. It doesn’t test what a tool does when called, so a version can match and still behave differently. (Thanks, Wasilis and Dylan.) Real example, so you know why step 3 matters: I compared two versions of one MCP server, each started twice in a sandbox with no internet. Its tool list went from 278 to 311 (33 added, none removed). 8 existing tools changed a description or schema. The README didn’t change. I called no tool, so I can’t say what any of it does, and nothing says the maker did anything wrong.