# Confirm Mcp

> MCP server for human approvals. Any MCP agent gets a request_approval tool: pause on risky actions, a human approves or edits, then resume.

- **Type:** MCP server
- **Install:** `agentstack add mcp-confirm-ai-confirm-mcp`
- **Verified:** Yes — security-reviewed for prompt injection and unsafe behavior
- **Seller:** [confirm-ai](https://agentstack.voostack.com/s/confirm-ai)
- **Installs:** 0
- **Category:** [Integrations](https://agentstack.voostack.com/c/integrations)
- **Latest version:** 0.1.0
- **License:** MIT
- **Upstream author:** [confirm-ai](https://github.com/confirm-ai)
- **Source:** https://github.com/confirm-ai/confirm-mcp

## Install

```sh
agentstack add mcp-confirm-ai-confirm-mcp
```

Requires the [AgentStack CLI](https://agentstack.voostack.com/docs/cli). Works with Claude Code, Cursor, and any MCP-compatible agent.

## About

# confirm-mcp

An [MCP](https://modelcontextprotocol.io) server that gives any MCP-compatible agent (Claude Desktop, Cursor, and others) a human-approval tool. Before the agent does something irreversible, it calls `request_approval`, a human approves or edits the action at [confirm.dev](https://confirm.dev), and the agent proceeds with the approved result. Every decision is logged.

## Setup

Get an API key at [confirm.dev](https://confirm.dev), then add the server to your MCP client config.

**Claude Desktop** (`claude_desktop_config.json`):

```json
{
  "mcpServers": {
    "confirm": {
      "command": "npx",
      "args": ["-y", "confirm-mcp"],
      "env": { "CONFIRM_API_KEY": "cfm_live_..." }
    }
  }
}
```

That's it. The agent now has two tools.

## Tools

### `request_approval`

Pause and ask a human to approve a sensitive action. Blocks until the human decides or the wait elapses.

| Input | Description |
|---|---|
| `summary` | One line the human reads, e.g. "Refund $10,000 to customer #4821". Required. |
| `notify` | Approver email, or `group:` to escalate to an approver group. Required. |
| `payload` | The exact action as structured data. The human can edit it before approving. |
| `reasoning` | Why the agent wants to do this. |
| `recent_actions` | The agent's recent steps, for context (max 10). |
| `ttl_minutes` | How long the request stays valid (5 to 10080). |
| `wait_minutes` | How long to block before returning "pending" (default 15). |

On **APPROVED**, the tool returns the `effectivePayload` to use (the human may have edited it). On **REJECTED** or **EXPIRED**, it tells the agent to stop. If the wait elapses while still pending, it returns the request id so the agent can poll later.

### `check_approval`

Poll a previously created request by `id` to see whether a human has decided.

## Why a tool, not a prompt

The approval is enforced server-side: the agent cannot fake a verdict, and every decision is recorded in an immutable audit log. Teaching the agent *when* to call this (via a system prompt or an [agent skill](https://confirm.dev/docs)) is the coverage layer; the tool is the enforcement layer.

For production agents where you need guaranteed coverage of specific actions, use the deterministic policy engine in [`@confirm/sdk`](https://www.npmjs.com/package/@confirm/sdk) (`guard()`) rather than relying on the model to remember to call the tool.

Docs: [confirm.dev/docs](https://confirm.dev/docs). Node 18+.

## Development

This package is developed in a private monorepo alongside the Confirm.dev service and mirrored here on every release, which is why the history starts at the first public release. Issues and PRs are welcome; PRs get cherry-picked upstream.

Build: `npm install && npm run build`. Test: `node smoke.mjs` (after a build; uses a mocked client, no network).

## Source & license

This open-source MCP server is cataloged on AgentStack and links to its original source — we do not rehost the code.

- **Author:** [confirm-ai](https://github.com/confirm-ai)
- **Source:** [confirm-ai/confirm-mcp](https://github.com/confirm-ai/confirm-mcp)
- **License:** MIT

Install and usage instructions live in the source repository linked above.

## Pricing

- **Free** — Free

## Security capabilities

Automated source analysis of v0.1.0 — what this tool can access:

- **Network access:** no
- **Filesystem access:** no
- **Shell / process execution:** no
- **Environment & secrets:** no
- **Dynamic code execution:** no

*"Yes" means the capability is present in the source — more access means more to trust, not that it is unsafe.*


## Versions

- **0.1.0** — security scan: passed — Imported from the upstream source.

## Links

- Listing page: https://agentstack.voostack.com/l/mcp-confirm-ai-confirm-mcp
- Seller: https://agentstack.voostack.com/s/confirm-ai
- Browse the marketplace: https://agentstack.voostack.com/browse

---
Listed on AgentStack — the marketplace for AI agent skills and MCP servers. Every listing is security-reviewed. Creators keep 70%.