Bifrost Gateway lets you split MCP tools into what the agent can call vs what runs without approval

Default MCP behavior across most setups: the model suggests a tool call, it comes back to your application, your app decides whether to execute it, calls the execute endpoint, feeds the result back. Your application manages the full loop.

Bifrost has an Agent Mode that moves this into the gateway.

Two lists per MCP client:

tools_to_execute — tools the model is allowed to call
tools_to_auto_execute — subset that runs without coming back to your app for approval

Auto-executable tools run in parallel. When a response has both types, Bifrost executes the approved ones, then returns:

- content: JSON summary of what already ran
- tool_calls: only the tools still waiting for approval
- finish_reason: "stop"

Nothing auto-executes by default. The list is empty until explicitly configured. A tool in tools_to_auto_execute that isn't in tools_to_execute is ignored entirely.

Config:

{
  "name": "filesystem",
  "tools_to_execute": ["*"],
  "tools_to_auto_execute": ["read_file", "list_directory"]
}

read_file and list_directory run automatically.
write_file comes back for approval.

Max agent depth defaults to 10 iterations, per-tool timeout defaults to 30 seconds, both configurable.

Docs: https://docs.getbifrost.ai/mcp/agent-mode
GitHub: https://github.com/maximhq/bifrost