When a harness advertises MCP form-mode elicitation, Graft asks in place: the harness shows the ask, you answer, and the call proceeds or is refused without leaving the chat. Hermes does this. OpenClaw does not, and every approval reaches you as a link instead.

​
What the ask says

Graft’s message names your agent, the tool or connection, the vendor and every host it reaches, and says what your yes means. For a tool it quotes the tool’s description, marked as the agent’s model’s own words, and says what kind of tool it is:
  • for a write tool, This tool can change data at the vendor.
  • for a destructive tool, This tool is destructive, it can delete or overwrite data.
Either way it then says that your answer holds for this agent from now on, and that you can turn on Ask every time for this tool on the agent’s page in the console if you would rather be asked before each call. When that setting is already on, the message says so and that this answer is for this call only. For a build ask it says that your agent wants Graft to run code against the connection, the moment Graft’s model starts reading your data there through dry-run reads, and asks to allow it once for this agent and this connection. The form itself is two booleans, Allow and Ask every time for this tool. Accepting without either field counts as allow and leaves the setting as it stands.

​
Hermes

Hermes renders the form as its own approval card with four buttons: Allow Once, Allow Session, Always Allow and Deny.
All three are one accept to Graft, with no fields set. Graft does not guess which was pressed, so:
  • On a write or destructive tool, any of them records the yes and it holds for this agent from now on, even when the button said once. Graft asks once by rule, and a destructive tool is no exception.
  • None of them changes whether the tool asks every time. That switch is in the console, on the ask or on the agent’s page, and the card’s text says so.
  • On a build ask, any of them grants the build approval for this agent and connection.
Hermes keeps no memory on its elicitation path, so its card appears on every ask Graft makes. If the card comes back for a tool you already allowed, you have set that tool to ask every time; turning the setting off on the agent’s page is what stops it. If Hermes cannot carry the elicitation for any reason, Graft falls back to the console link, so you are still asked.

​
OpenClaw

OpenClaw does not advertise elicitation, so it never shows an ask. The call returns awaiting_approval with a link, the agent relays it, and you answer under Pending actions in the console. The call waits a short while for you first; answer within it and the call proceeds. Otherwise tell the agent when you are done, it calls again, and the answer is there.

​
Any other client

A client that advertises form-mode elicitation gets the same two-boolean form Hermes does, and can set askEveryCall if it renders the field. A client that advertises nothing gets the link. See Any MCP client.

​
What never comes through the harness

A secret. A connection’s key, an OAuth client secret, a rotated token: those are always a link into the console, on every harness, because the MCP specification forbids requesting sensitive information through elicitation and Graft follows it. If an ask in your harness wants a key, it did not come from Graft.

​
Try it