MCP calls can run before permission mediation and surface as execute wrappers

[jovijovi]

Versions

• @agentclientprotocol/codex-acp: 1.2.0
• Codex CLI: 0.147.0
• ACP protocol version: 1

Summary

In an ACP session configured for read-only operation, Codex can route a read through an MCP tool invoked from a JavaScript/code-mode wrapper. codex-acp surfaces the outer wrapper as an ACP tool call with kind: "execute", but the underlying MCP calls have already run without a preceding session/request_permission request.

This prevents an ACP client from enforcing a simple policy that allows reads but denies execution: the client sees an unapproved execute event only after the operation has occurred.

Minimal reproduction

1. Configure Codex with an MCP server that exposes a read-only lookup tool.
2. Start codex-acp and create a new ACP session in read-only mode.
3. Have the ACP client permit read operations but not execute operations.
4. Ask Codex to inspect a fixture through the available read path.
5. Correlate the ACP tool-call IDs with the Codex structured events.

The relevant code-mode activity is equivalent to:

const resources = await tools.list_mcp_resources({});
const result = await tools.<read_only_mcp_tool>({ /* lookup arguments */ });

Actual behavior

• The MCP resource listing and read-only lookup run without a preceding ACP permission request.
• codex-acp reports the JavaScript/code-mode wrapper as ACP kind: "execute".
• The ACP client cannot approve or reject the operation before it occurs.
• No shell command or file mutation is involved in the reproduced case.

Expected behavior

codex-acp should preserve enough information about the underlying MCP operation for the ACP client to mediate it before execution.

If the adapter cannot prove that the underlying operation is read-only, it should request execute permission before invoking it, or fail closed. It should not execute the MCP call first and then surface only the outer JavaScript wrapper as an unapproved execute event.

A useful regression test would cover a read-only session with:

• resource enumeration;
• a read-only MCP lookup;
• no execute grant; and
• an assertion that no MCP operation completes before the required ACP permission decision.