LibreChat/api/server/controllers
Aron Gates 301ba801f4
feat: implement tool approval checks for agent tool calls
Ports the tool approval feature from aron/tool-approval branch onto the
latest codebase. Adds manual user approval flow for tool calls before
execution, configurable via librechat.yaml toolApproval config.

Key changes:
- Add TToolApproval schema to data-provider config (required/excluded patterns)
- Add approval.ts utilities (requiresApproval, matchesPattern, getToolServerName)
- Add MCPToolCallValidationHandler for flow-based approval via FlowStateManager
- Wrap non-MCP tools with approval in ToolService.loadAgentTools
- Add MCP tool validation in MCP.js createToolInstance
- Handle native Anthropic web search approval in callbacks.js
- Disable native web_search when approval required (OpenAI initialize)
- Add validation SSE delta handling in useStepHandler
- Add approve/reject UI in ToolCall.tsx with confirm/reject API calls
- Add validation routes: POST /api/mcp/validation/confirm|reject/:id
- Add i18n keys for approval UI
- Add toolApproval example config in librechat.example.yaml

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
2026-04-03 11:22:27 +01:00
..
__tests__ 🧹 chore: Move direct model usage from PermissionsController to data-schemas 2026-03-21 15:20:15 -04:00
agents feat: implement tool approval checks for agent tool calls 2026-04-03 11:22:27 +01:00
assistants 💰 fix: Lazy-Initialize Balance Record at Check Time for Overrides (#12474) 2026-03-30 22:51:07 -04:00
auth 🛡️ fix: Add Origin Binding to Admin OAuth Exchange Codes (#12469) 2026-03-30 16:54:00 -04:00
AuthController.js 🔏 fix: Remove Federated Tokens from OpenID Refresh Response (#12264) 2026-03-16 09:23:46 -04:00
AuthController.spec.js 🔏 fix: Remove Federated Tokens from OpenID Refresh Response (#12264) 2026-03-16 09:23:46 -04:00
Balance.js 📦 refactor: Consolidate DB models, encapsulating Mongoose usage in data-schemas (#11830) 2026-03-21 14:28:53 -04:00
EndpointController.js refactor: Integrate Capabilities into Agent File Uploads and Tool Handling (#5048) 2024-12-19 13:04:48 -05:00
FavoritesController.js 📌 feat: Pin Agents and Models in the Sidebar (#10634) 2025-12-11 16:38:20 -05:00
mcp.js 🏗️ feat: 3-Tier MCP Server Architecture with Config-Source Lazy Init (#12435) 2026-03-28 10:36:43 -04:00
ModelController.js 🏗️ refactor: Remove Redundant Caching, Migrate Config Services to TypeScript (#12466) 2026-03-30 16:49:48 -04:00
PermissionsController.js 🧹 chore: Move direct model usage from PermissionsController to data-schemas 2026-03-21 15:20:15 -04:00
PluginController.js 🏗️ refactor: Remove Redundant Caching, Migrate Config Services to TypeScript (#12466) 2026-03-30 16:49:48 -04:00
PluginController.spec.js 🏗️ refactor: Remove Redundant Caching, Migrate Config Services to TypeScript (#12466) 2026-03-30 16:49:48 -04:00
tools.js 📦 refactor: Consolidate DB models, encapsulating Mongoose usage in data-schemas (#11830) 2026-03-21 14:28:53 -04:00
TwoFactorController.js 🔑 fix: Require OTP Verification for 2FA Re-Enrollment and Backup Code Regeneration (#12223) 2026-03-14 01:51:31 -04:00
UserController.js 🧵 feat: ALS Context Middleware, Tenant Threading, and Config Cache Invalidation (#12407) 2026-03-26 17:35:00 -04:00
UserController.spec.js 🗂️ refactor: Migrate S3 Storage to TypeScript in packages/api (#11947) 2026-03-21 14:28:55 -04:00