Codex mcp-server can hang indefinitely when command approval requires elicitation but MCP client cannot answer

What version of Codex CLI is running?

codex-cli 0.101.0

What subscription do you have?

ChatGPT Pro (Individual)

Which model were you using?

gpt-5.3-codex

What platform is your computer?

Linux 6.8.0-90-generic x86_64 x86_64 (Ubuntu 24.04)

What terminal emulator and version are you using (if applicable)?

_No response_

What issue are you seeing?

When using codex mcp-server from an MCP client (Claude Code v2.1.34) that does not respond to elicitation/create (or
does not surface approval UI), tool calls can block indefinitely if a command requires approval.

This is reproducible when approval-policy and sandbox are omitted and an unsafe command is
selected (example: pipeline with sort).

Observed behavior:

• No final tool response is returned.
• The turn remains stuck until manual cancellation.
• In multi-tool scenarios, one blocked approval can delay/hold completion of other finished tool

calls.

What steps can reproduce the bug?

1. Start MCP server:

• codex mcp-server

1. Call MCP tool codex without explicitly setting approval-policy / sandbox.
2. Prompt it to run:

• echo -e 'banana\napple\ncherry' | sort

1. Wait for tool response.

Reproducible result:

• Request hangs (no response for long time / indefinitely).

Control:

• Same prompt with approval-policy: "never" and sandbox: "danger-full-access" returns

immediately.

What is the expected behavior?

codex mcp-server should fail fast instead of hanging when approval cannot be completed via MCP
client.

Expected options:

• Detect missing elicitation support during initialize and reject approval-requiring execution with a

clear error.

• Or apply a timeout to approval elicitation and return a structured error.
• Or provide explicit documented behavior/fallback for non-elicitation clients.

Additional information

Relevant source references:

• No client capability gating on initialize path: codex-rs/mcp-server/src/message_processor.rs:183
• Elicitation request callback has no timeout: codex-rs/mcp-server/src/outgoing_message.rs:42
• Approval wait in core path is await-based (can block until decision): `codex-rs/core/src/

codex.rs:2168`

• Unsafe classification depends on command allowlist (sort is not in allowlist): `codex-rs/shell-

command/src/command_safety/is_safe_command.rs:56`

• In-flight tool futures are ordered; head-of-line blocking can delay later completions: `codex-rs/

core/src/codex.rs:5237`