Approved MCP tools still require repeated manual approval

What version of Codex CLI is running?

0.125.0

What subscription do you have?

Pro Lite

Which model were you using?

gpt-5.4, gpt-5.5

What platform is your computer?

Darwin 25.4.0 arm64 arm

What terminal emulator and version are you using (if applicable)?

Terminal.app, codex app

What issue are you seeing?

Codex repeatedly shows an interactive approval prompt before running approved MCP tools. The user must manually choose:

1. Allow Run the tool and continue.
2. Cancel

This blocks autonomous operation and defeats the purpose of approval_policy=never for safe, approved repository-inspection tools.

Impact
This breaks expected hands-off workflows for:

• Code review
• Suggestion adjudication
• Repository discovery
• Architecture impact analysis
• Pretty much any task that requires repo investigation using these tools

It also makes long-running or delegated agent workflows unreliable because execution can stall on low-risk tool calls that should be automatic.

Examples of tool calls needing approval:
1.
"Calling codanna.analyze_impact({"symbol_id":3105,"max_depth":2})

Field 1/1
Tool call needs your approval. Reason: Payload includes encrypted content and a tool call requesting code execution — needs user
confirmation and clarification of intent/permissions.

max_depth: 2
symbol_id: 3105

› 1. Allow Run the tool and continue.

1. Cancel Cancel this tool call

enter to submit | esc to cancel"

"Calling codanna.semantic_search_with_context({"query":"ChannelManager updateChannel resolvedContent cache invalidation contentFilters
sortOrder playbackMode shuffleSeed","lang":"typescript","limit":3,"threshold":0.25})

Field 1/1
Tool call needs your approval. Reason: Requested code changes and commits require repository access and confirmation of scope.

lang: typescript
limit: 3
query: ChannelManager updateChannel resolvedContent cache invali...
threshold: 0.25

› 1. Allow Run the tool and continue.

1. Cancel Cancel this tool call

enter to submit | esc to cancel"

What steps can reproduce the bug?

Have codanna and ripgrep MCPs enabled and just use codex as normal.
Uploaded thread: 019dc0e1-8cbd-7020-8417-403bcd8d2a48

What is the expected behavior?

When approval_policy = "never" is active and the MCP tool is approved/trusted, Codex should run these MCP tool calls automatically without prompting.

Additional information

I know there is an auto-review feature using a subagent but I dont want to waste usage on this especially since these tools from these MCP's are not a concern to me.