Every sensible MCP client does ask by default. They have changed that to auto-allow, likely after going through a pop-up warning about this exact issue, and now

Every sensible MCP client does ask by default. They have changed that to auto-allow, likely after going through a pop-up warning about this exact issue, and now proclaim surprise.