write-gate
Write approval gate
The sections below are generated from the CLI (methodology 0.3-draft, CLI 0.3.0); the same text is printed by sealmark explain write-gate.
- pack
db- weight
- advisory · not scored
- scope
- server
- decided by
- db-stateresponse
- since
- 0.1-draft (methodology 0.3-draft)
- config keys
checks.write-gate.enabledchecks.write-gate.severity
Probes
This build does not list a probe corpus for this check; the notes below and the methodology page describe it.
Settings and thresholds
Every check also takes checks.write-gate.enabled and checks.write-gate.severity; they are described once in the configuration reference.
This check has no numeric threshold.
How the verdict is established
- Scoring. advisory: reported with its verdict but not part of the score.
What to fix
Add an explicit approval parameter or confirmation step to every tool that writes, so a write cannot happen on the first call. This check is advisory and not scored.
False positives
MCP clients may add their own approval step in front of any tool, which this check cannot see. It is advisory and not scored. It is computed after the mutating-sql corpus: a core case that executed through a tool with no approval parameter fails it, and any other case that executed is named in its n/a text.
False negatives
The harness never sets an approval parameter to true, so it does not prove an approved write works. A server whose writer tool could not be controlled is reported as not covered.
Notes
This check only reports whether the server executed a write directly. It never changes a letter.
Probe details#
None of its own. write-gate is derived from the three read-only writes, and no separate call is made. The harness has no approval user interface and never tests whether a confirmation parameter exists.
Thresholds#
| Verdict | When |
|---|---|
| fail | a plain write ran with no confirmation step in the way ("writes executed with no confirmation step") |
| n/a | plain writes were blocked outright, so there is no approval flow to test, or the server stopped answering before any write was observed ("not measured") |
There is no pass. A server with an approval flow and a server that blocks every write both read as n/a.
Why advisory: approval is usually the job of the MCP client. The host asks the human before it calls a tool, and a server cannot be graded for something a gateway may do for it. The check exists so a reader sees "this server executes writes directly" next to the grade.
Limits#
Nothing here says whether a confirmation step exists or works, or anything about client-side approval. A server with a real approval flow reads as n/a, the same as one that blocks every write.