MCP Toolbox for Databases read-only SQL call is blocked by safety guard after explicit approval (interactive mode)

[shima-t-a]

What version of Codex CLI is running?

codex-cli 0.125.0

What subscription do you have?

Business

Which model were you using?

gpt-5.3-codex

What platform is your computer?

macOS

What terminal emulator and version are you using (if applicable)?

No response

What issue are you seeing?

Codex can't execute SQL via MCP Toolbox for Databases because

• Tool call was cancelled because of safety risks
• Reason references annotation mismatch such as:
  • destructive_hint: true
  • read_only_hint: false

What steps can reproduce the bug?

1. Configure Codex with an MCP server using MCP Toolbox for Databases prebuilt SQL tools:
   • Repo: https://github.com/googleapis/mcp-toolbox
   • Docs: https://cloud.google.com/bigquery/docs/pre-built-tools-with-mcp-toolbox
2. In an interactive Codex session, call the MCP SQL execution tool with a read-only SELECT query.
3. Explicitly approve the MCP tool call when prompted.
4. Observe the tool call result.

What is the expected behavior?

After explicit user approval, a read-only SELECT query should execute.

Additional information

• Related but different issue: MCP tool calls always cancelled in exec mode with 'user cancelled MCP tool call' #16685 (exec-mode cancellation).
• This report is about interactive mode where a read-only SQL call is blocked by safety classification.

Suggested fixes

1. Respect explicit approval for clearly read-only SQL patterns (SELECT/CTE without DDL/DML), or
2. Add SQL-aware safety classification before hard block, or
3. Provide a deterministic override flow for this mismatch class.

[gpayer]

I have a similar problem with codex version 0.128.0 with a different mcp server of my own. For unknown reasons one specific tool is suddenly refused and it sucks sooo hard. There is not even the option to manually allow it.
The new safety system is pretty bonkers and annoying.

[GlebGlebovAKAJJ]

I'm positive about it. ARC just doesn't give a damn about the approval_policy = "on-request" and approvals_reviewer = "user" parameters that can be used in config.toml. With approval_policy = "never", it also skips "dangerous" tool calls. The funny thing is that ARC doesn't pay attention to my directives, even though I've stated dozens of times, in different ways, that the agent is allowed to use those tool calls. Neither developer_instructions nor sandbox_mode = "danger-full-access" seems to help with ARC, though.