Block Elicitation From an Unlisted MCP Server

Elicitation pops a form in front of the human on behalf of a connected MCP server. If that server isn't one you deliberately trusted, declining its request to show the human a dialog at all is safer than trusting the form's contents to be benign.

MCP & Config Safety Event: Elicitation Claude Code Open source · Free

1. Save this as the hook script

#!/usr/bin/env python3
"""Elicitation hook — declines a request from any MCP server not in
ALLOWED_SERVERS. Edit the list for your own project."""
import json, sys

data = json.load(sys.stdin)
server_name = data.get("server_name", "")

ALLOWED_SERVERS = {"edgar_mcp", "portfolio_risk_mcp", "accounting_mcp"}

if server_name not in ALLOWED_SERVERS:
    print(f"BLOCKED: elicitation request from unlisted MCP server '{server_name}'.", file=sys.stderr)
    sys.exit(2)

sys.exit(0)

Save to a path inside your project, e.g. .claude/hooks/block-elicitation-unlisted-server.sh, then chmod +x it.

2. Wire it into .claude/settings.json

{
  "hooks": {
    "Elicitation": [
      {
        "hooks": [
          {"type": "command", "command": "python3 .claude/hooks/block-elicitation-unlisted-server.py"}
        ]
      }
    ]
  }
}

Before you use this

A hook runs with your local shell's permissions — review the script above before adding it, the same way you'd review any script you didn't write yourself. See our guide on hook security risks for the specific CVEs this category of feature has already produced.

Related hooks

Warn on Auto-Approved MCP Servers
The defensive counterpart to CVE-2025-59536 — flags a repo's own settings before you trus…
Warn on MCP Server Tool-List Drift ("Rug-Pull" Detection)
Flags when a previously-trusted MCP server's declared tool set changes mid-project.
Block MCP Tool Calls Outside an Allowlist
Denies any mcp__ tool call whose server prefix isn't on an explicit allowlist.
Log Every Elicitation Decision for an MCP Trust Register
A durable record of every elicitation request shown, and whether it was accepted or decli…
← All hooks
FEEDBACK