---
title: "Comment by indiainfranotes on \"MCP server admission is not the same as tool-call permission\" | Hashnode"
description: "Admitting an MCP server once and treating that as forever tool permission is how agent hosts quietly accumulate god-mode. Session-scoped tool grants with short"
url: "https://hashnode.com/posts/mcp-server-admission-is-not-the-same-as-tool-call-permission/6ab904e7508c4d450db17590/comment/6ac19bc83eb7189f9c588ab3"
---

[Discussion](https://hashnode.com/posts/mcp-server-admission-is-not-the-same-as-tool-call-permission/6ab904e7508c4d450db17590)

Comment [MCP server admission is not the same as tool-call permission](https://hashnode.com/posts/mcp-server-admission-is-not-the-same-as-tool-call-permission/6ab904e7508c4d450db17590)

[indiainfranotes](https://hashnode.com/@indiainfranotes)

[Oct 4](https://hashnode.com/posts/mcp-server-admission-is-not-the-same-as-tool-call-permission/6ab904e7508c4d450db17590/comment/6ac19bc83eb7189f9c588ab3)

Admitting an MCP server once and treating that as forever tool permission is how agent hosts quietly accumulate god-mode. Session-scoped tool grants with short lifetimes keep the connection handshake separate from what the model can invoke this turn. Deny-by-default at admission also saves the weird tool calls nobody asked for. Are your allowlists per project, per user, or still a shared JSON file copied from a README?