gemini-cli - 💡(How to fix) Fix Feature Request: Plan Mode opt-in to trust MCP server readOnlyHint annotations [1 pull requests]

What would you like to be added?

An opt-in setting general.plan.trustReadOnlyHint (boolean, default false) that, when enabled, allows MCP tools annotated with readOnlyHint: true to execute silently in Plan Mode instead of triggering the approval dialog on every call.

Built-in read tools (read_file, glob, grep_search, list_directory, ...) already run silently in Plan Mode via the explicit allow-list in read-only.toml; this setting extends the same silent-read UX to MCP servers the user explicitly trusts.

Why is this needed?

Today in Plan Mode, every MCP tool annotated readOnlyHint = true triggers an ask_user confirmation (see packages/core/src/policy/policies/plan.toml, priority-50 rule). For users who have configured trusted MCP servers (e.g. their own internal docs server, a private repo browser), this means every single read call requires manual approval — even though the same agent can read local files silently.

The default Plan Mode behavior should stay secure (the bot's security review on #27156 is exactly right — never trust unvalidated metadata from third-party MCP servers by default). But users who configured a server they fully trust should be able to opt in to the same silent-read flow that built-in tools already enjoy.

Additional context

This is the rationale @gemini-code-assist[bot] surfaced in #27156:

The change from PolicyDecision.ASK_USER to PolicyDecision.ALLOW for tools with the readOnlyHint annotation in Plan Mode introduces a security bypass. Security decisions should be managed by the policy engine based on verified tool identity (tool.name), not by unvalidated hints from external MCP servers.

The opt-in setting addresses this exactly: the default remains ASK_USER, and only an explicit per-installation opt-in flips the decision to ALLOW — and only for readOnlyHint-annotated MCP tools, never write-tools.

PR #27156 implements this design. It injects a dynamic rule at policy-engine construction with priority 4.5 (above plan.toml's 1.05 ASK_USER, below MCP_EXCLUDED_PRIORITY = 4.9 so admin/security server-blocks still win).

Related: #25406 (Epic: Plan Mode Post-Launch Work).