MCP Toolbox for Databases read-only SQL call is blocked by safety guard after explicit approval (interactive mode)

What version of Codex CLI is running?

codex-cli 0.125.0

What subscription do you have?

Business

Which model were you using?

gpt-5.3-codex

What platform is your computer?

macOS

What terminal emulator and version are you using (if applicable)?

_No response_

What issue are you seeing?

Codex can't execute SQL via MCP Toolbox for Databases because

• Tool call was cancelled because of safety risks
• Reason references annotation mismatch such as:
• destructive_hint: true
• read_only_hint: false

What steps can reproduce the bug?

1. Configure Codex with an MCP server using MCP Toolbox for Databases prebuilt SQL tools:

• Repo: https://github.com/googleapis/mcp-toolbox
• Docs: https://cloud.google.com/bigquery/docs/pre-built-tools-with-mcp-toolbox

1. In an interactive Codex session, call the MCP SQL execution tool with a read-only SELECT query.
2. Explicitly approve the MCP tool call when prompted.
3. Observe the tool call result.

What is the expected behavior?

After explicit user approval, a read-only SELECT query should execute.

Additional information

• Related but different issue: #16685 (exec-mode cancellation).
• This report is about interactive mode where a read-only SQL call is blocked by safety classification.

Suggested fixes

1. Respect explicit approval for clearly read-only SQL patterns (SELECT/CTE without DDL/DML), or
2. Add SQL-aware safety classification before hard block, or
3. Provide a deterministic override flow for this mismatch class.