Skip to content
MCPDev

MCP tool call requires approval, but approval policy is never

Spec
2026-07-28
Evidence
E3Tested in a real clientarm64
Verified

What it means

Section titled “What it means”

Codex asks before it runs an MCP tool. In the non-interactive codex exec there is nobody to ask, and the approval policy is never, so the call is refused. With Codex CLI 0.164.0 and our example server, the tool call failed with:

MCP tool call requires approval, but approval policy is never

The server itself was fine: listing its tools worked, and the same call succeeded once the tools were approved.

Codex exec cannot ask you

Section titled “Codex exec cannot ask you”

For a server you trust, approve its tools ahead of time in config.toml:

[mcp_servers.hello-ts]
command = "node"
args = ["/absolute/path/to/server.ts"]
default_tools_approval_mode = "approve"

or for one run only, on the command line:

Terminal window
codex exec -c 'mcp_servers.hello-ts.default_tools_approval_mode="approve"' "…" < /dev/null

With this setting our call to add returned {"sum":5}.

If you need to approve each call, run Codex interactively instead of codex exec.

Section titled “Related”

MCPDev is community documentation. It is not affiliated with the Model Context Protocol project or with the vendors of the clients it covers.