# Dangerous tool approvals via Zalo

Teddy MCP does **not** auto-approve dangerous tools when `TEDDY_AUTO_APPROVE_DANGEROUS=false`.

## Flow

1. Agent calls a dangerous MCP tool (e.g. `teddy-live__teddy_comment_set_status`).
2. Response includes `preview: true`, `requires_approval`, `approval_token`, and a summary.
3. Agent messages Zalo (zalouser) with a fixed format:

```
⚠️ Teddy needs approval
Tool: comment.set_status
Summary: …
Token: <approval_token>
Reply: approve <token>
```

4. Human replies `approve <token>` (or paste the token after “approve”).
5. Agent re-invokes the **same tool** with the **same input** plus:
   - `approved`: true
   - `approval_token`: `<token>`

Tokens expire (~1 hour) and are one-time use.

## Do not

- Set `TEDDY_AUTO_APPROVE_DANGEROUS=true` on live.
- Reuse a token for different input.
- Skip the preview step.