A host supports code mode. A user approves a model-written script that loops over 40 records and calls a server's delete_record tool once per record from inside the sandbox. According to MCP client guidance, how should the host broker handle those 40 tool calls?
Select an answer to reveal the explanation.
Short Explanation
Signing off on a to-do list isn't the same as signing a blank cheque for every item on it. In code mode the broker is still the host, so you check each tool call the script makes. The trap is thinking script approval, or the sandbox's lack of network, makes per-call checks unnecessary.
Full Explanation
In programmatic tool calling the sandbox never talks to servers itself; function stubs are intercepted and the host broker dispatches each one as a tools/call request. The client best-practices guidance says the broker is still the MCP host for specification purposes, so it applies the same human-in-the-loop confirmation policy to sandbox-originated calls as to direct ones. A host may grant categorical approval, such as allowing one tool for this script run instead of prompting every iteration, but the broker must still evaluate each call against that grant. Treating script approval as blanket approval is exactly what the guidance rules out, because what the code does at runtime can differ from what the user expected. Network isolation keeps the sandbox from reaching the internet directly, yet every brokered call still reaches a real server and can delete real data, so it is no reason to skip confirmation. Handing tokens to generated code violates the rule that credentials stay with the host, which adds authentication only when forwarding the call. Exam caveat: tool results from one server are untrusted input to the next brokered call, so input review applies too. Operational check: run a test script against a destructive tool and confirm the broker logs a policy decision for every call it forwards.