@@ -87,6 +87,13 @@ func approveMCPServersWithTTY(resolved config.ResolvedConfig, stdin io.Reader, s
 			continue
 		}
 
+		// Operator-marked trusted: auto_approve granted in the global
+		// config (the loader strips project-level declarations, so a
+		// cloned repo cannot reach this branch for an unvetted server).
+		if cfg.AutoApprove {
+			continue
+		}
+
 		if !tty {
 			return fmt.Errorf(
 				"project-level MCP server %q (%s %q) requires explicit approval\n"+
@@ -248,7 +255,9 @@ func approveMCPToolsWithTTY(projectDir, serverName string, cfg mcpclient.ServerC
 		}
 
 		key := mcpToolApprovalKey(projectDir, serverName, def.Name, cfg, schemaHash, def.Description)
-		if approved[key] {
+		// Schema guard scans and size caps above still ran — auto_approve
+		// removes the prompt friction, not the safety checks.
+		if cfg.AutoApprove || approved[key] {
 			out = append(out, def)
 			continue
 		}
 
@@ -199,6 +199,47 @@ func TestMCPApprovalKey_IncludesEnv(t *testing.T) {
 	}
 }
 
+// An operator-granted auto_approve (loader semantics: only the global
+// config can set it) must skip the server prompt entirely — an empty stdin
+// proves no prompt was attempted, since a prompt would fail the read.
+func TestApproveMCPServers_AutoApproveSkipsPrompt(t *testing.T) {
+	setupTestHome(t)
+	resolved := config.ResolvedConfig{
+		MCPServers: map[string]mcpclient.ServerConfig{
+			"trusted": {Command: "node", Args: []string{"server.js"}, AutoApprove: true},
+		},
+		ProjectMCPServerNames: []string{"trusted"},
+	}
+
+	var out bytes.Buffer
+	err := approveMCPServersWithTTY(resolved, strings.NewReader(""), &out, true)
+	if err != nil {
+		t.Fatalf("auto-approved server errored: %v", err)
+	}
+	if strings.Contains(out.String(), "Approve?") {
+		t.Errorf("auto-approved server still prompted: %q", out.String())
+	}
+}
+
+// Per-tool prompts are skipped for auto-approved servers, while schema
+// guard scans still run (a poisoned schema is rejected, not prompted).
+func TestApproveMCPTools_AutoApproveSkipsToolPrompts(t *testing.T) {
+	setupTestHome(t)
+	cfg := mcpclient.ServerConfig{Command: "node", Args: []string{"server.js"}, AutoApprove: true}
+	defs := []mcpclient.ToolDef{
+		{Name: "fetch", Description: "Fetch a URL"},
+		{Name: "query", Description: "Run a query"},
+	}
+	out, err := approveMCPToolsWithTTY("/proj", "trusted", cfg, defs,
+		strings.NewReader(""), &bytes.Buffer{}, true, nil, guard.Config{})
+	if err != nil {
+		t.Fatalf("auto-approved tools errored: %v", err)
+	}
+	if len(out) != 2 {
+		t.Fatalf("auto-approved tools = %d, want 2", len(out))
+	}
+}
+
 func TestApproveMCPServers_PromptShowsEnvValues(t *testing.T) {
 	setupTestHome(t)
 	resolved := config.ResolvedConfig{
 
@@ -700,6 +700,7 @@ func handleMCPServers(resolved config.ResolvedConfig) http.HandlerFunc {
 			Command          string   `json:"command"`
 			Args             []string `json:"args,omitempty"`
 			Project          bool     `json:"project,omitempty"`
+			AutoApprove      bool     `json:"auto_approve,omitempty"`
 			TimeoutSeconds   int      `json:"timeout_seconds,omitempty"`
 			MaxResponseBytes int64    `json:"max_response_bytes,omitempty"`
 			MaxResultChars   int      `json:"max_result_chars,omitempty"`
@@ -711,6 +712,7 @@ func handleMCPServers(resolved config.ResolvedConfig) http.HandlerFunc {
 				Command:          cfg.Command,
 				Args:             cfg.Args,
 				Project:          project[name],
+				AutoApprove:      cfg.AutoApprove,
 				TimeoutSeconds:   cfg.TimeoutSeconds,
 				MaxResponseBytes: cfg.MaxResponseBytes,
 				MaxResultChars:   cfg.MaxResultChars,
 
@@ -136,6 +136,13 @@ Each server is defined by:
   artifact refs. Malformed results are never silently truncated into place
 - `artifact_roots` — optional directories under which `file://` artifact refs
   are accepted; **empty (default) rejects every artifact ref (fail closed)**
+- `auto_approve` — optional operator trust flag (`true`/`false`, default
+  `false`): the server skips the project-server approval prompt and the
+  per-tool registration prompts (schema guard scans and size caps still
+  apply). **Honor rules**: the flag is only honored from the operator-owned
+  `~/.odek/config.json` — a `./odek.json` declaration is stripped with a
+  warning, because a cloned repo must never be able to approve its own MCP
+  servers. See [Auto-approving trusted servers](#auto-approving-trusted-servers).
 
 The four limit fields are the **odek-extension/v1** server config schema;
 see [EXTENSIONS.md](EXTENSIONS.md) for the normative contract.
@@ -191,6 +198,8 @@ Approval methods:
    ```
 3. **Persisted approvals** — approvals are stored in
    `~/.odek/mcp_approvals.json` (0600) keyed by project directory + server name
+4. **`auto_approve: true`** in the global config — pre-trust a server and
+   skip both prompts; see [Auto-approving trusted servers](#auto-approving-trusted-servers)
    + command + args + sorted `env` map hash + the odek-extension/v1 limit
    fields (`timeout_seconds`, `max_response_bytes`, `max_result_chars`,
    `artifact_roots`). If any of these change, you are prompted again — editing
@@ -202,6 +211,37 @@ Approval methods:
 If approval is required and cannot be obtained, odek aborts before spawning any
 MCP server.
 
+### Auto-approving trusted servers
+
+`auto_approve: true` removes the approval friction for servers you have
+vetted — no server prompt, no per-tool prompts. Because the entire point of
+the approval gate is that `./odek.json` is attacker-controllable (any repo
+you clone could ship one), the flag obeys strict trust rules:
+
+- **Global config (`~/.odek/config.json`)** — honored. Set it on a global
+  server entry, or on any server you run.
+- **Global trust marker for a project server** — a command-less global entry
+  whose name matches a project-defined server applies the flag to it:
+
+  ```jsonc
+  // ~/.odek/config.json — "I trust whatever 'my-dev-server' is in this
+  // project family, don't ask me again":
+  { "mcp_servers": { "my-dev-server": { "auto_approve": true } } }
+  ```
+
+  The marker itself never becomes a connectable server. Changing the
+  project's command/args no longer re-prompts (your global trust covers the
+  name), which is the convenience trade-off you are opting into — revoke by
+  deleting the marker.
+- **Project config (`./odek.json`)** — **ignored with a warning**. A repo
+  you cloned cannot approve its own MCP servers; the operator's global
+  config is the only source of this trust.
+
+Safety nets that always remain, regardless of the flag: per-tool schema
+guard scans and size caps, built-in-name shadowing rejection, subprocess
+env sanitization, artifact-ref fail-closed validation, and the extension
+limits. `auto_approve` removes prompts, not checks.
+
 ### Project-level MCP tool approval
 
 After a project-level server is approved, each individual tool it advertises via
 
@@ -1085,10 +1085,33 @@ func LoadConfig(cli CLIFlags) ResolvedConfig {
 		sort.Strings(projectSandboxOverride.Volumes)
 	}
 
+	// Project-level auto_approve is a self-approval attempt surface: a
+	// cloned repo must never be able to mark its own MCP servers trusted.
+	// Strip it (the operator can grant the same trust from the global
+	// config, where it is honored).
+	for name, mc := range project.MCPServers {
+		if mc.AutoApprove {
+			fmt.Fprintf(os.Stderr, "odek: WARNING: ignoring mcp_servers.%s.auto_approve from project config (%s); set auto_approve in ~/.odek/config.json to trust this server\n", name, ProjectConfigPath())
+			mc.AutoApprove = false
+			project.MCPServers[name] = mc
+		}
+	}
+
 	// Start with global, overlay project
 	cfg := overlayFile(FileConfig{}, global)
 	cfg = overlayFile(cfg, project)
 
+	// Global auto_approve trust markers survive the project overlay: when
+	// the global config carries the flag for a name the project defines
+	// (preserved in overlayFile below) the merged server keeps it. A marker
+	// with no definition behind it (auto_approve + empty command) is not a
+	// server — drop it so nothing tries to connect to it.
+	for name, mc := range cfg.MCPServers {
+		if mc.AutoApprove && mc.Command == "" {
+			delete(cfg.MCPServers, name)
+		}
+	}
+
 	// Remember which MCP servers came from the project config so commands can
 	// require explicit approval before spawning potentially untrusted subprocesses.
 	projectMCPNames := make([]string, 0, len(project.MCPServers))
@@ -2474,6 +2497,13 @@ func overlayFile(base, override FileConfig) FileConfig {
 			base.MCPServers = make(map[string]mcpclient.ServerConfig)
 		}
 		for k, v := range override.MCPServers {
+			// An operator-set auto_approve on the base (global) entry is
+			// trust metadata for the NAME: it survives even when the
+			// project overrides the definition. (Project-side auto_approve
+			// is stripped before this point.)
+			if prev, ok := base.MCPServers[k]; ok && prev.AutoApprove {
+				v.AutoApprove = true
+			}
 			base.MCPServers[k] = v
 		}
 	}
 
@@ -6,6 +6,7 @@ import (
 	"testing"
 
 	"github.com/BackendStack21/odek/internal/guard"
+	"github.com/BackendStack21/odek/internal/mcpclient"
 )
 
 func TestLoadConfig_GuardDefaults(t *testing.T) {
@@ -137,6 +138,74 @@ func TestLoadConfig_GuardCLIOverridesEnv(t *testing.T) {
 	}
 }
 
+// auto_approve trust rules: project declarations are stripped (a cloned
+// repo must not self-approve), global entries keep it, and a command-less
+// global entry acts as a trust marker for a project-defined server of the
+// same name — without becoming a connectable server itself.
+func TestLoadConfig_MCPAutoApproveTrustRules(t *testing.T) {
+	home := t.TempDir()
+	wd := t.TempDir()
+	t.Setenv("HOME", home)
+
+	// Global config: a fully-trusted real server, and a trust marker for a
+	// project-defined name.
+	global := `{
+	  "mcp_servers": {
+	    "global-trusted": {"command": "node", "args": ["g.js"], "auto_approve": true},
+	    "project-marker": {"auto_approve": true},
+	    "lonely-marker": {"auto_approve": true}
+	  }
+	}`
+	if err := os.MkdirAll(filepath.Join(home, ".odek"), 0700); err != nil {
+		t.Fatal(err)
+	}
+	if err := os.WriteFile(filepath.Join(home, ".odek", "config.json"), []byte(global), 0600); err != nil {
+		t.Fatal(err)
+	}
+
+	// Project config: defines "project-marker" (must inherit the global
+	// trust) and tries to self-approve "rogue" (must be stripped).
+	project := `{
+	  "mcp_servers": {
+	    "project-marker": {"command": "node", "args": ["p.js"]},
+	    "rogue": {"command": "sh", "args": ["-c", "echo pwned"], "auto_approve": true}
+	  }
+	}`
+	if err := os.WriteFile(filepath.Join(wd, "odek.json"), []byte(project), 0600); err != nil {
+		t.Fatal(err)
+	}
+
+	origGetwd, _ := os.Getwd()
+	os.Chdir(wd)
+	defer os.Chdir(origGetwd)
+	cfg := LoadConfig(CLIFlags{})
+
+	servers := cfg.MCPServers
+	if len(servers) != 3 {
+		t.Fatalf("resolved servers = %d (%v), want 3", len(servers), serverNames(servers))
+	}
+	if s := servers["global-trusted"]; !s.AutoApprove || s.Command != "node" {
+		t.Errorf("global-trusted = %+v, want AutoApprove with command preserved", s)
+	}
+	if s := servers["project-marker"]; !s.AutoApprove || s.Command != "node" {
+		t.Errorf("project-marker = %+v, want global trust marker applied to the project definition", s)
+	}
+	if s := servers["rogue"]; s.AutoApprove {
+		t.Error("project-level auto_approve was honored — a cloned repo could self-approve its MCP server")
+	}
+	if _, ok := servers["lonely-marker"]; ok {
+		t.Error("command-less trust marker became a connectable server entry")
+	}
+}
+
+func serverNames(m map[string]mcpclient.ServerConfig) []string {
+	names := make([]string, 0, len(m))
+	for k := range m {
+		names = append(names, k)
+	}
+	return names
+}
+
 func TestLoadConfig_GuardProjectRejected(t *testing.T) {
 	wd := t.TempDir()
 	t.Setenv("HOME", t.TempDir())
 
@@ -217,6 +217,18 @@ type ServerConfig struct {
 	// against these roots by the artifact subsystem (internal/artifact)
 	// before the result is rendered for the model.
 	ArtifactRoots []string `json:"artifact_roots,omitempty"`
+
+	// AutoApprove marks the server as trusted by the operator: it skips the
+	// project-server approval prompt and the per-tool registration prompts
+	// (schema guard scans still apply). TRUST RULES: the flag is honored
+	// only when it comes from the operator-owned global config
+	// (~/.odek/config.json) — either on a global server entry or as a
+	// command-less trust marker for a project-defined server name. The
+	// config loader strips auto_approve from project ./odek.json with a
+	// warning: a cloned repo must never be able to approve its own MCP
+	// servers. Trust metadata only — deliberately excluded from approval
+	// keys, which hash execution-relevant fields.
+	AutoApprove bool `json:"auto_approve,omitempty"`
 }
 
 // lineResult carries the result of a single readLine from the reader goroutine.