What happened
StudioCat released version 0.7.0 on October 31, 2026. The macOS app lets ChatGPT on the web work with local projects over MCP, including editing files, running tests, and using Git. In this release, users can approve or deny risky commands in a confirmation card inside the ChatGPT conversation. The choices are to deny, allow once, or remember an eligible rule for that project. Users can also answer the same request from StudioCat’s pending tray. In-chat approvals can be turned off in Settings in favor of native dialogs.
The release tightens confirmations around destructive actions. Deleting files and discarding uncommitted Git changes require confirmation. Deleting outside a project or deleting protected folders requires a one-time decision. High-risk command rules cannot be newly remembered, while eligible rules can be added or revoked in project permissions. StudioCat says command-name rules distinguish commands from search text and ordinary arguments; argument forms that could execute other commands still require confirmation. Terminal access remains off until enabled for a project. The release notes stress that these checks help prevent mistakes but do not sandbox arbitrary scripts.
A new pending tray collects outstanding confirmations and incomplete patch-recovery records, with project badges and a top-bar indicator. If a patch cannot fully roll back, the record lets a user inspect files, check for external changes, and restore only when current permissions and file contents allow it. Recovery records live in memory and disappear when StudioCat quits; they are not crash recovery. Pending confirmations also do not survive quitting. If a disconnected session’s result is unknown, the notes advise checking status before repeating an action.
The Settings → MCP Tools page lists tools offered to ChatGPT, grouped as read-only, writing, and destructive, and exposes their parameters and schemas. It is informational and does not change permissions. Users must refresh the StudioCat connector in ChatGPT after updating to load current tool definitions and card templates. The release retains existing permissions, settings, and conversation bindings. It requires macOS 14 or later. The release defaults to free mode, which supports one visible project; multiple project tabs require a license, with licensed availability to be announced separately. Downgrading to 0.6.0 is unsupported and may discard newer policy fields or alter conversation bindings and history.
What the archive adds
Claude’s Workspace beta also put approval controls alongside work on files, but in Google Workspace rather than a local MCP bridge. StudioCat is a new release, not a restatement: its specific contribution is command-level confirmation inside ChatGPT for local project actions.
Trend signal
This is a modest example of agent security moving to runtime boundaries. StudioCat places decisions at the boundary where an agent’s commands affect a project, and keeps terminal access disabled until enabled. The source also limits the claim: confirmations are not a general execution sandbox.
Connections to other events
An earlier channel post described ChatGPT’s support for MCP Apps, where embedded interfaces communicate through a shared bridge. StudioCat’s confirmation cards meet that direction from the tool-provider side: a local MCP workspace surfaces a permission decision in the host conversation. The release does not say that its cards implement MCP Apps.
Why it matters
A confirmation prompt is useful only if a person can understand which action is about to happen and make a decision before it runs. StudioCat’s release gives builders a concrete design to study: present the decision in the assistant’s conversation, offer a single-use permission, and limit which rules can be remembered. A shared tray also makes pending approvals and recovery work easier to find than scattered prompts.
The more important engineering lesson is the boundary the release does not cross. Command checks can classify known command patterns and protect some destructive operations, but StudioCat explicitly says they do not sandbox arbitrary scripts. Teams should not treat an approval card as a substitute for process isolation, scoped credentials, or review of the actual execution environment. Nor should users assume pending state is durable: approvals and patch recovery records are lost when the app quits. These distinctions matter whenever a hosted assistant can affect a developer’s local files or terminal.
Limits and uncertainty
The release notes describe StudioCat’s own controls; they do not provide independent security testing, measured reductions in mistakes, or a complete threat model. They expressly say command checks are not a sandbox. The source does not establish how the controls perform against novel command patterns or malicious project content. It also says pending confirmations and patch-recovery records do not survive quitting, and that recovery records are not crash recovery. Licensed multi-project availability is not specified beyond a future announcement. No price or license terms are given.
Reader takeaway
StudioCat 0.7.0 makes local-agent command approvals more legible by putting them in the ChatGPT conversation and collecting pending decisions in one tray. Treat that as a usability and permission layer, not as containment: the release itself says it is not a sandbox, and its pending state is temporary.