MCP tool approval_mode=approve still prompts when encrypted tool payload cannot be inspected

What happened?

A configured local MCP server tool still triggered an approval prompt even though both the server default and the specific tool were configured with approval_mode = "approve".

The prompt reason shown by Codex was:

Encrypted assistant message and tool call in payload — unclear if allowed.

The tool call itself was a read-only Unity MCP console-log query with these arguments:

includeError: true
includeWarning: true
includeInfo: false

Relevant config

~/.codex/config.toml contains:

[mcp_servers.unity]
url = "http://127.0.0.1:8787/mcp"
supports_parallel_tool_calls = false
default_tools_approval_mode = "approve"

[mcp_servers.unity.tools.unity_get_console_logs]
approval_mode = "approve"

Other Unity MCP tools are also configured with approval_mode = "approve".

Expected behavior

Codex should trust the configured MCP tool approval mode and run the tool without asking for user approval.

Actual behavior

Codex displayed an approval prompt anyway, with this reason:

Encrypted assistant message and tool call in payload — unclear if allowed.

This appears to happen before or outside the normal MCP approval-mode handling, because the configured approve setting should have allowed the call.

Workaround

Calling the same local MCP server directly over HTTP from shell avoids the prompt:

Invoke-RestMethod -Uri 'http://127.0.0.1:8787/mcp' -Method Post -Body $body -ContentType 'application/json'

So the issue seems specific to Codex's MCP wrapper/tool approval path, not the MCP server itself.

Environment

• OS: Windows
• MCP server: local HTTP server at 127.0.0.1:8787
• Codex config uses MCP default_tools_approval_mode = "approve"
• Tool involved: unity_get_console_logs