Dangerous tool approvals via Zalo

Dangerous tool approvals via Zalo Teddy MCP does not auto-approve dangerous tools when TEDDY_AUTO_APPROVE_DANGEROUS=false. Flow Agent calls a dangerous MCP tool (e.g. teddy-live__teddy_comment_set_status). Response includes preview: true, requires_approval, approval_token, and a summary.…

v2 approvals-zalo.md Download markdown Updated July 18, 2026

Dangerous tool approvals via Zalo#

Teddy MCP does not auto-approve dangerous tools when TEDDY_AUTO_APPROVE_DANGEROUS=false.

Flow#

  1. Agent calls a dangerous MCP tool (e.g. teddy-live__teddy_comment_set_status).
  2. Response includes preview: true, requires_approval, approval_token, and a summary.
  3. Agent messages Zalo (zalouser) with a fixed format:
⚠️ Teddy needs approval
Tool: comment.set_status
Summary: …
Token: <approval_token>
Reply: approve <token>
  1. Human replies approve <token> (or paste the token after “approve”).
  2. Agent re-invokes the same tool with the same input plus:
    • approved: true
    • approval_token: <token>

Tokens expire (~1 hour) and are one-time use.

Do not#

  • Set TEDDY_AUTO_APPROVE_DANGEROUS=true on live.
  • Reuse a token for different input.
  • Skip the preview step.