MCP tools don't respect sandboxing.

What version of Codex is running?

0.65.0

What subscription do you have?

Pro

Which model were you using?

_No response_

What platform is your computer?

_No response_

What issue are you seeing?

While building the dictator, i noticed that tools can bypass sandbox restriction.

A tool can do network call or write in the file system even when codex is in read-only mode.

What steps can reproduce the bug?

1) use a MCP that can do modify or do network calls.
2) assure you are in read-only approval mode
3) Ask llm to use the tool
4) File system change.

What is the expected behavior?

the MCP i linked above is a pre-linter, it has 2 tools. the diagnostic one should work in readonly, but the autofixer should not.

The agent should not be able to by pass sandboxing with tools.

Additional information

I already fixed this locally by modifying codex to remove any tool that has destructive annotation or no annotation.

In short, anything that is suspect should not be provided agent. MCP server authors should upgrade their spec to support annotation.

If no body is working on it, i can open a PR.