An approved MCP connector isn't approved forever

MCP connectors give AI agents access to other systems. They might search documents, update a CRM, create tickets, query databases, or perform dozens of other actions.

When an administrator connects one of those systems, there is a natural assumption behind it. I approved what this connector can do.

But connectors change. A provider can add new tools, an existing tool can change what information it accepts or what it can do, and even a tool's description can shift in a way that affects how an AI agent understands and uses it. That raises a simple governance question. If what was approved changes, is it still approved? In Agent Anything, the answer is no.

Approval applies to what was actually reviewed

When a managed MCP connector is reviewed in Agent Anything, we record the tool capabilities that were present at that time. An administrator decides which tools are disabled, which require confirmation, and which can run without asking every time.

If a later check finds that those capabilities have changed, the new version does not silently inherit the old approval. The previously approved version and the newly observed version are kept separate, new tools stay disabled, and agents attached to the connector do not simply continue using the changed capabilities. Unattended schedules are also prevented from running through the change without review, and a user can reconnect their own account credentials, but that does not give them authority to approve a different workspace capability surface.

We can't always detect a remote change the instant it happens. What matters is what happens once a changed connector is observed. Previous trust does not automatically expand to cover something nobody reviewed.

The same question is worth asking of any agent platform. When a connector changes what it can do, does the previous approval apply only to what was actually reviewed, or does the platform assume that because a connector was trusted once, whatever it exposes later is trusted too? Those are very different security models, and only one of them treats approval as something earned rather than assumed.

An approved connection should not be a permanent approval of future capabilities. In Agent Anything, it isn't.