Tool approvals for MCP and connector calls
By Steven Van ·
Developers can set require_approval to "always" or a filter, then approve or deny each call; Python SDK 0.43.8 and TypeScript SDK 0.38.8 add the types.
Perplexity's Agent API can now hold mcp and connector tool calls for review before they run. Setting require_approval on either tool type turns the check on. Without it, calls still run with no approval, as before.
How the approval flow works
When a call needs approval, the response includes an mcp_approval_request item and the call does not run. To approve or deny it, send an mcp_approval_response with previous_response_id. For connector calls, the request item also carries connector_id, the ID of the connector that proposed the call.
Choosing which calls to review
- Use "always" to review every call.
- Use a filter object to skip approval for selected tools, or for read-only tools.
- Leave require_approval omitted, null or "never" to run calls without approval.
Limits with the sandbox
Approvals apply only to connector calls that appear as mcp_call items. They do not cover commands that use connector credentials inside the Sandbox. For a connector that supports both paths, any policy other than "never", including a filter object, switches it to its MCP tools so calls can pause for a decision. The Sandbox then does not receive that connector's credentials. For GitHub, this means git and gh commands in the Sandbox run without authentication.
SDK support
The Python SDK 0.43.8 and TypeScript SDK 0.38.8 include the approval types. Details are in Perplexity's MCP approvals and Connectors documentation.