Summary

• default run-scoped MCP servers to defaultToolsApprovalMode: approve while preserving explicit overrides
• emit Codex default_tools_approval_mode per MCP server
• map Claude full-access to --dangerously-skip-permissions
• bump @tutti-os/agent-acp-kit to 0.7.3 and document the trusted local behavior

Test evidence

• pnpm typecheck
• pnpm exec vitest run tests --maxWorkers=1 (215 passed)
• pnpm build
• pnpm pack:check
• pnpm test:packed-consumer

The default parallel test invocation hit unrelated subprocess timing flakes on this host; serial execution passed the full suite.

Risk

• MCP tools now run without an approval prompt unless a host explicitly sets auto, prompt, or writes. This is intended for run-scoped application MCP servers carrying short-lived host tokens.
• Claude full-access now uses the CLI-native skip-permissions flag instead of the permission-mode alias.

AI assistance

Implementation and tests were prepared with Codex assistance.