Permission modes

Every tool is tagged with a risk level, and the mode you pick decides which tools stop and ask you before they run. There are two modes: Safe Edit and Full Control. You set the mode in the app; the MCP server enforces it, so the model can't exceed it no matter what it asks for.

Safe Edit

The recommended default. Creating and editing (files, nodes, scripts, scene changes) just happens. Anything destructive or anything that runs code, such as deleting a file, running the project, enabling a plugin, or an arbitrary editor script, stops and asks you first, with a sentence saying what is about to happen. Say yes and it runs; say no and the AI is told you declined. Nothing is off the table, and nothing irreversible happens without a human beat in between.

The same question protects project.godot, export_presets.cfg, the .godot/ cache, and the Godot MCP Studio addon itself. Structured editor tools such as setting the main scene, window settings, autoloads, and input actions never ask, because they change project.godot through the editor's own settings API instead of rewriting the file.

Where the question appears

Questions go to Godot MCP Studio, so they look the same whichever AI client you use. Approve or deny in the app and the tool continues. Keep the app running while you work with the AI.

If the app is not running, the question goes to your MCP client instead. Some clients cannot show one, and a few answer it themselves without showing you anything. There, the tool reports that it could not ask, and you can open the app or switch to Full Control for that one call.

A tool waits about 90 seconds for an answer. After that it tells the AI the approval is still waiting; the question stays in the app for an hour, so approve it whenever you get to it and ask the AI to try again, and the second call goes through on the answer you already gave.

Installing an add-on that ships native code always asks, in every mode.

Auto-approval

The Approvals list has one Auto-approval row covering everything it can answer for you: editor actions and, in the full edition, Image Studio generation. Turn it on and a long run of edits stops asking at every delete. You pick what is allowed, how many, and how long the session lasts, 15 minutes, an hour or four, and you can pause it at any time. It is stored on this device and never leaves it.

Add-ons with native code are excluded unless you pick them, because they run code inside the editor. Even then they come only from the reviewed list and are checked against their source and checksum before anything is written. Image generation has its own credit limits, per image and per session, so automation cannot spend more than you allow.

The editor half follows your permission mode. In Safe Edit it covers edits and deletes, which is what Safe Edit stops for. In Full Control those already run without asking, so the only editor question left is the native add-on install, and that is all the row offers there.

Full Control

Everything, including deletes and running editor code, and it never asks. Picking Full Control is the decision to let the AI work unattended, so use it when you trust the workflow and want it to move fast. Drop back to Safe Edit when you want to be asked again.

Risk levels, briefly

• Read: never changes anything.
• Write: creates or edits.
• Destructive: deletes or overwrites; Safe Edit asks, Full Control runs.
• Execute: runs editor code or launches processes; Safe Edit asks, Full Control runs.

Generated client configs do not include a mode. The mode is set only in the desktop app and applies on the next tool call, with no client restart and no config change. Servers started from older configs that still pass --mode use that value only as a fallback until the app sets a mode. When in doubt, stay in Safe Edit; you can always switch to Full Control for a single task.