The Approval Needed card is ToolPiper asking you, on your Mac, before something runs: a tool an agent called, or a request that would use a saved key you set to ask first. It says who is asking, what will happen and why approval is required, and it waits up to two minutes. Click Allow once to let that one action run, or Deny to refuse it. If you ignore the card until it expires, or close it, the action is refused and nothing runs.

What the card shows

  • Who is asking: the caller ToolPiper identified. An app that connected without a token reads as an unidentified caller on this Mac.
  • Reported client (not verified): the name the app gave for itself. ToolPiper shows it and does not vouch for it.
  • What will happen and Target: the tool or action, and what it acts on when ToolPiper can establish that. When it cannot, the card says so in orange. A shell command is one example: ToolPiper cannot establish everything a command does.
  • Why approval is required: the rule that made ToolPiper ask, such as your Security level, a tool you set to Ask, or a saved key set to ask first.
  • Expires in: the time left to answer.

The answers

A card about an action offers Deny and Allow once. A card for a tool may also offer Always deny, Allow for session and Always allow, which leave a rule for that tool. A tool that runs commands offers Allow once, Deny and Always deny only, so it asks before each run. When an app asks for a looser rule for a tool, the card offers Accept and Decline instead, and nothing is saved unless you accept.

The buttons respond one second after the card appears, so a click meant for another window cannot approve something you have not read.

When your password or Touch ID follows

After you click an answer that allows, macOS asks for your password or Touch ID when the action needs it: your Security level requires it for that kind of tool, the tool is set to require it, or a saved key is set to ask every time. The card never raises that prompt by itself. You click first.

Why it is a card and not the app's own prompt

An app that shows its own approval prompt asks there when a click is enough. The question comes to the card on your Mac when the app shows no prompt of its own, when the tool runs commands, and whenever your password or Touch ID is needed.

If you did not expect it

The card waits on top of your other windows until you answer it or it expires. Read who is asking and what will happen. If you do not recognise either, click Deny. To stop a tool from asking again, click Always deny on its card, or set it to Deny under MCP Tools.

What the app is told

A refused, closed or expired card tells the app that asked that the action did not run, and it can ask again. When several actions are waiting, the card shows them one at a time and says how many more are waiting.