What causes "The global MCP approval mode is not supported." in microsoft/aspire?

Use FoundryToolboxMcpGlobalApprovalMode.Never or .Always only.

microsoft/aspire · error · ArgumentOutOfRangeException

The global MCP approval mode is not supported.

Error message

The global MCP approval mode is not supported.

What it means

Only FoundryToolboxMcpGlobalApprovalMode.Never and .Always are valid global modes (they map to the wire values "never"/"always"). Any other enum member passed as Global fails this ArgumentOutOfRangeException at policy creation, before any JSON is emitted.

Solutions

Use FoundryToolboxMcpGlobalApprovalMode.Never or .Always only.
If the value comes from config/input, parse and validate it against the supported set before assigning.
Use Enum.IsDefined(typeof(FoundryToolboxMcpGlobalApprovalMode), value) plus a Never/Always check.
Catch ArgumentOutOfRangeException from policy creation and report the offending value.

Example fix

// before
var mode = (FoundryToolboxMcpGlobalApprovalMode)request.RawValue;
policy.Global = mode;
// after
var mode = request.RawValue is "always" ? FoundryToolboxMcpGlobalApprovalMode.Always : FoundryToolboxMcpGlobalApprovalMode.Never;
policy.Global = mode;

Defensive patterns

Strategy: validation

Validate before calling

if (mode is not (FoundryToolboxMcpGlobalApprovalMode.Never or FoundryToolboxMcpGlobalApprovalMode.Always))
    throw new ArgumentOutOfRangeException(nameof(mode), $"Unsupported global mode {mode}.");

Type guard

static bool IsSupportedMode(FoundryToolboxMcpGlobalApprovalMode m) =>
    m is FoundryToolboxMcpGlobalApprovalMode.Never or FoundryToolboxMcpGlobalApprovalMode.Always;

Try / catch

try { toolDefinition = CreateMcpTool(...); }
catch (ArgumentOutOfRangeException ex)
{ logger.LogError(ex, "Global approval mode {Mode} is not supported; use Never or Always.", mode); }

Prevention

Only assign the Never or Always enum members
Validate any enum values parsed from integers/config before assignment
Re-check supported modes after upgrading packages that own the enum

When it happens

Trigger: Passing an enum value outside the Never/Always set as the policy's Global property — e.g. an undefined or future enum value, or a value cast from an integer.

Common situations: Binding Global from configuration or user input where an unvalidated integer/number was cast to the enum; SDK version changes adding enum members the integration doesn't support yet.

Understand the failure class

Background: Invalid enum value errors: "Unknown type", "Invalid scope", "must be one of" — when a string is not on the library's allowed list — this error's family across 23 libraries.

Related errors

AI-assisted analysis of microsoft/aspire@25830f84bd (2026-09-16). Data as JSON: /api/errors/17f478d686e1c249. Report an issue: GitHub.

Appendix: source

Thrown at src/Aspire.Hosting.Foundry/Toolbox/FoundryToolboxToolDefinition.cs:243

        if (policy.Global is not null && (always is not null || never is not null))
        {
            throw new ArgumentException(
                "A global MCP approval policy cannot be combined with custom filters.",
                nameof(policy));
        }

        if (policy.Global is null && always is null && never is null)
        {
            throw new ArgumentException(
                "An MCP approval policy must specify a global mode or at least one custom filter.",
                nameof(policy));
        }

        if (policy.Global is not null &&
            policy.Global is not FoundryToolboxMcpGlobalApprovalMode.Never &&
            policy.Global is not FoundryToolboxMcpGlobalApprovalMode.Always)
        {
            throw new ArgumentOutOfRangeException(
                nameof(policy),
                policy.Global,
                "The global MCP approval mode is not supported.");
        }

        var overlap = always?.ToolNames
            .Intersect(never?.ToolNames ?? [], StringComparer.Ordinal)
            .FirstOrDefault();
        if (overlap is not null)
        {
            throw new ArgumentException(
                $"MCP tool '{overlap}' cannot both always and never require approval.",
                nameof(policy));
        }

        if (always?.ReadOnly is { } alwaysReadOnly && never?.ReadOnly == alwaysReadOnly)
        {
            throw new ArgumentException(

View on GitHub (pinned to 25830f84bd)