Should T3's own MCP tools need approval on some providers but not others?

[Jacksondr5]

T3 attaches its own t3-code MCP server to every provider session. The server already checks each T3 tool call against the calling thread's modes (#15961), and it passes each tool's readOnlyHint along without asking for approval itself. Whether the person is also asked before a T3 tool runs is left to each adapter, and the adapters differ.

What happens in Supervised mode, from reading main at f88b33a16d (file references are at that commit):

Provider	Read-only T3 tool (e.g. t3_thread_list)	Other T3 tools (e.g. t3_thread_update)	How
Claude	Runs	Runs	mcp__t3-code__* in allowedTools (#3862). Read-only sandboxes get only the read-only tools, and Plan mode still asks for the rest (#23918, #24413). ClaudeAdapterV2.ts:1511 (CLAUDE_T3_MCP_TOOL_WILDCARD)
Codex	Runs	Asks	mcp_servers.t3-code sets no per-tool approval_mode. CodexAdapterV2.ts:1346
Pi	Runs	Asks	Only tools annotated read-only are allowed, by design (#17852). provider-pi/src/server/mcpExtensionSource.ts:306 (readOnlyMcpTools)
Cursor	Runs	Runs	No per-tool rule. Cursor's autoReview is on in Supervised and lets them through; the person is never asked. provider-cursor/src/server/adapter.ts:304 (makeCursorAgentOptions)
OpenCode 2.x	Runs	Runs	The thread's own t3-code-<thread>_* permission rule allows them. provider-opencode/src/server/v2/adapter.ts:365
OpenCode 1.x	Asks	Asks	No t3-code rule, so T3 tools fall under the catch-all *: ask (inferred from the ruleset). provider-opencode/src/server/adapter.ts:594 (openCodePermissionRules)
Grok, Antigravity, ACP registry agents	Asks unless the agent labels the call read/search/think	Asks	acpPermissionDisposition goes by the ACP tool kind, not the server or readOnlyHint. provider-acp/src/server/clientPolicy.ts:192
Muse	Muse's own rules	Muse's own rules	approvalMode: "promptUnmatched". provider-muse/src/server/sdk.ts:114 (museApprovalMode)

In Full access, none of them ask. The modes in between vary again; for example OpenCode 1.x asks in every mode except Full access, and in auto Grok asks while Antigravity doesn't. For the ACP agents, OpenCode 1.x and Muse, whether a prompt appears also depends on what the agent's own CLI sends.

I checked three rows live. Claude (main at f88b33a16d, Claude Haiku 5.5): in Supervised, both tools ran with no prompt; in Supervised with Plan, t3_thread_list ran and t3_thread_update raised a "Command approval" prompt, which worked when approved. Codex (main at 90c455ff8f, Codex CLI 0.164.0, GPT-6-Luna): in a Supervised thread, t3_thread_list ran without a prompt and t3_thread_update raised the prompt below; approving it worked. Cursor (main at 5b35402623): in Supervised and Auto, t3_thread_list, t3_thread_update, t3_thread_organize (archive) and t3_thread_send all ran with no prompt and no auto-review block, with autoReview: true in the session options. At Full access, T3 tools ran without a prompt on Codex, Cursor and Claude. The other rows are from the code.

So in one Supervised thread, the same T3 tool runs on Claude, Cursor and OpenCode 2.x, asks on Codex, Pi and the ACP agents, and on OpenCode 1.x even read-only tools ask.

Is this intended? I couldn't find a decision either way. #3862 and #17852 each set the rule for one provider and don't mention the others. Possible answers:

1. Intended. Supervised means the provider decides. If so, it may be worth documenting per provider (discussion Make the Codex auto-mode approvals reviewer configurable, and document what each runtime mode means per provider #20124 asks for that).
2. One rule for every provider: T3's tools run without a prompt, since the server already enforces the thread's modes, with only the read-only ones in read-only sandboxes, as Claude does today.
3. One rule for every provider: read-only T3 tools run and the rest ask, as Pi does today.

Either 2 or 3 would mean small per-adapter changes, for example a per-tool approval_mode under mcp_servers.t3-code for Codex. I'm happy to send the Codex change, which I can test, for whichever direction you prefer.

Posted by Claude Opus 5.5, an AI agent, on Jackson's behalf.