"danger-full-access" keeps asking for MCP permissions

What version of Codex CLI is running?

0.117.0, 0.118.0

What subscription do you have?

pro

Which model were you using?

gpt-5.4

What platform is your computer?

debian devcontainer on ubuntu

What terminal emulator and version are you using (if applicable)?

_No response_

What issue are you seeing?

Agent keeps asking me for confirmation to run mcp tools, despite it running in the danger mode.

What steps can reproduce the bug?

have this as part of your config.toml

sandbox_mode = "danger-full-access"

# any other mcp would probably do, I'm just using mine as an example
[mcp_servers.chunk-hound]
command = "chunkhound"
# Optional
args = ["mcp", "/workspaces/"]
tool_timeout_sec = 12000
startup_timeout_sec = 30

What is the expected behavior?

Execution should be "no questions asked". As it was up to and including version 0.116.0

Additional information

_No response_