Great question! The agent asks you with every call to our MCP whether you would like to "Deny"/"Allow once"/"Allow always", that way you can keep read calls on auto-approve and review the write calls one by one to stay on the safe side :)

you can see it here: https://adchestra.com/#how, the step 4 shows you the exact approval pop-up in Claude.