Raw mcp_servers write tools cannot be configured to auto-approve in Codex desktop (Playwright + Linear) #15437

Summary

In the Codex desktop app on macOS, raw MCP server tools that mutate state still show approval popups on every write action, even when shell approvals are disabled.

I can reproduce this with:

• mcp__playwright__browser_click
• mcp__linear__save_issue

This feels related to #15169, but appears broader than Playwright. Linear mutating tools show the same pattern.

What I want

I want certain trusted MCP servers/tools to run without any popup at all.

Not:

• approve every call
• approve for this session

I want:

• always run automatically for specific trusted MCP servers/tools

Current behavior

Even with:

approval_policy = "never"
sandbox_mode = "danger-full-access"

Codex desktop still prompts for raw MCP write actions such as Playwright clicks and Linear save_issue.

The popup is the MCP tool approval dialog, not the normal shell/sandbox approval flow.

Why this seems like a product gap / bug

From the docs, Codex supports app-level tool approval config like:

• apps.<id>.default_tools_approval_mode = "approve"
• apps.<id>.tools.<tool>.approval_mode = "approve"

But I could not find a documented equivalent for raw MCP servers such as:

• mcp_servers.<id>.approval_mode
• mcp_servers.<id>.tools.<tool>.approval_mode

My local setup uses raw MCP server config:

[mcp_servers.playwright]
command = "npx"
args = ["-y", "@playwright/mcp@latest"]

[mcp_servers.linear]
url = "https://mcp.linear.app/mcp"

So as far as I can tell, there is currently no supported way to say:

• always auto-approve writes from playwright
• always auto-approve writes from linear

Reproduction

1. Configure Codex desktop with:

   approval_policy = "never"
   sandbox_mode = "danger-full-access"

2. Configure raw MCP servers, for example:

   [mcp_servers.playwright]
   command = "npx"
   args = ["-y", "@playwright/mcp@latest"]
   
   [mcp_servers.linear]
   url = "https://mcp.linear.app/mcp"

3. In the desktop app, invoke:

   • a Playwright write action like browser_click
   • a Linear write action like save_issue

4. Observe that Codex still shows approval popups.

Expected behavior

One of these should exist:

1. A documented config path for raw MCP servers, something like:

   • mcp_servers.<id>.default_tools_approval_mode = "approve"
   • mcp_servers.<id>.tools.<tool>.approval_mode = "approve"

2. Or approval_policy = "never" should optionally allow trusted raw MCP writes to run automatically instead of prompting.

Actual behavior

• Shell approvals can be disabled.
• Raw MCP write approvals still surface.
• There is no obvious config path to make trusted raw MCP writes auto-run.

Extra notes

• I inspected local config and state and did not find a persisted per-tool approval cache explaining this behavior.
• This is not just a Playwright issue on my machine; Linear mutating MCP tools behave the same way.
• If this is intentional, the docs could be clearer that raw mcp_servers.* do not currently support auto-approve for mutating tools.
• If this is not intentional, it looks like a desktop/MCP approval-layer bug or missing feature.

Environment

• Codex desktop app
• macOS
• Reproduced on March 22, 2026