codex - 💡(How to fix) Fix MCP Toolbox for Databases read-only SQL call is blocked by safety guard after explicit approval (interactive mode) [1 participants]

What version of Codex CLI is running?

codex-cli 0.125.0

What subscription do you have?

Business

Which model were you using?

gpt-5.3-codex

What platform is your computer?

macOS

What terminal emulator and version are you using (if applicable)?

No response

What issue are you seeing?

Codex can't execute SQL via MCP Toolbox for Databases because

• Tool call was cancelled because of safety risks
• Reason references annotation mismatch such as:
  • destructive_hint: true
  • read_only_hint: false

What steps can reproduce the bug?

1. Configure Codex with an MCP server using MCP Toolbox for Databases prebuilt SQL tools:
   • Repo: https://github.com/googleapis/mcp-toolbox
   • Docs: https://cloud.google.com/bigquery/docs/pre-built-tools-with-mcp-toolbox
2. In an interactive Codex session, call the MCP SQL execution tool with a read-only SELECT query.
3. Explicitly approve the MCP tool call when prompted.
4. Observe the tool call result.

What is the expected behavior?

After explicit user approval, a read-only SELECT query should execute.

Additional information

• Related but different issue: #16685 (exec-mode cancellation).
• This report is about interactive mode where a read-only SQL call is blocked by safety classification.

Suggested fixes

1. Respect explicit approval for clearly read-only SQL patterns (SELECT/CTE without DDL/DML), or
2. Add SQL-aware safety classification before hard block, or
3. Provide a deterministic override flow for this mismatch class.