MCP require_approval invalid values can fail open #3168

Please read this first

• Have you read the docs? Yes. I checked the Agents SDK docs and the MCP approval guidance.
• Have you searched for related issues? Yes. I searched issues/PRs for MCP require_approval invalid always never overlap approval fail open and require_approval alwyas typo approval MCP; I did not find an exact match. Nearby PRs such as fix(mcp): reject non-object tool input JSON #3135/fix: reject non-object function tool input JSON #3166 cover non-object tool argument JSON, not approval policy normalization.

Describe the bug

MCPServer._normalize_needs_approval() can silently turn invalid require_approval configuration into a policy that does not require approval.

Three cases currently fail open:

1. A typo in a string policy, e.g. "alwyas", normalizes to False.
2. A typo in a tool-name mapping, e.g. { "delete": "alwyas" }, is ignored and returns an empty mapping.
3. A tool listed in both TS-style always.tool_names and never.tool_names is silently overridden by never, so it does not require approval.

This is risky for MCP servers with sensitive or destructive tools because a user can believe approval is enabled while the SDK exposes the tool without HITL approval.

Debug information

• Agents SDK version: 0.16.0
• Source revision tested: eed9100
• Python version: Python 3.12.1

Repro steps

Run this from the repository root on current main:

from agents.mcp.server import MCPServer

cases = [
    ("string_typo", "alwyas"),
    ("mapping_typo", {"delete": "alwyas"}),
    (
        "overlap",
        {
            "always": {"tool_names": ["delete"]},
            "never": {"tool_names": ["delete"]},
        },
    ),
]

for name, value in cases:
    result = MCPServer._normalize_needs_approval(require_approval=value)
    print(f"{name}: {result!r}")

Actual output:

string_typo: False
mapping_typo: {}
overlap: {'delete': False}

Expected behavior

Invalid approval configuration should not silently disable approval.

My expected behavior would be fail-fast validation with a clear error for:

• string policies other than "always" or "never"
• mapping values other than booleans, "always", or "never"
• duplicate tool names listed in both always.tool_names and never.tool_names

I have not opened a PR yet because this changes external configuration validation semantics. Please confirm whether fail-fast validation is the preferred behavior, or whether you would prefer a warning/fail-closed compatibility path.