Can an MCP server ever know a human really answered an elicitation?

I'm working on an approval gate for destructive MCP tools. The server asks the human through MCP elicitation, so the model never sees the approval step.

A commenter pointed out a hole: in Claude Code, a hook on the Elicitation event can exit 0 with action "accept" and answer the request with no dialog. The server only receives accept, so it can't tell a person from a script. A project .claude/settings.json in a cloned repo could register such a hook once the folder is trusted.

What I'm considering:

• Log "client-accepted" instead of "approved", so the audit file never claims a human was involved.
• Run the allowlist and policy checks before any elicitation, so a scripted accept can't override them.
• Refuse irreversible tools when I can't tell how the answer was produced.

My question: is there any reliable way for an MCP server to know that a real person answered an elicitation? Or should the design assume it can't know, and rely on reversibility and quarantine instead?

I haven't checked which other clients let a script answer elicitation. If you know of any, please tell me. The project is open source, so PRs and issues are welcome.