Codex auto-review

In the Auto access mode, Codex runs exactly as its own “Approve for me” mode: the workspace-write sandbox, approvals on request, and Codex’s auto-review. Codex’s reviewer, a model, looks at each request to leave the sandbox, each network request and each MCP tool prompt, and approves or denies it. You get a card only where Codex still asks a person.

This needs runner 0.6.1 or later. The runner’s profile row in Settings › Runners says auto-review when it is on.

What you see

Each finished review is one line in the run’s transcript, for example:

Auto-review allowed: pnpm check (risk medium)

There is no card and nothing to decide. A review that fails denies the request, and three denials in a row end the turn with “permission denied”.

If Codex refuses the reviewer when the run starts, the runner tries once more without it and says so in one notice. Cards then work as they do in Ask.

When you still get a card

• You set mcp-approval ask on the profile: then Codex asks a person about everything that needs approval, and the reviewer is off.
• The profile has an approval-policy override other than on-request.
• The profile is in Ask or Full.

Cards that remember

When a Codex command does come to you as an Allow card, it may offer more than Allow and Deny:

Button	What it does
Allow	This one request
Allow for this run	Codex won’t ask again for this exact command in this run
Always allow <prefix>	Only when Codex proposes a command prefix. Codex adds a rule to its own rules file on that runner, for that Codex home. Matching commands then run outside the sandbox without asking, in Minga’s runs and in your own Codex sessions on that home.
Deny	Refuse it

Always allow is broad and permanent

A short prefix, such as pnpm, lets every matching command out of the sandbox from then on. To undo it, edit the rules file in that Codex home (~/.codex/rules/default.rules for the default home).

Network prompts and prompts to write to a running process offer only Allow and Deny.

Turn it off

To be asked about everything instead:

minga profile set codex-personal mcp-approval ask   # stay in Auto, without the reviewer
minga profile set codex-personal access ask         # or switch the profile to Ask

Things to know

• The reviewer is a model, not a guarantee. Codex’s own documentation says so.
• Each review costs a model call and takes a few seconds.
• An MCP server whose own Codex config says to prompt is reviewed by Codex’s reviewer in Auto, not asked. Choose mcp-approval ask to be asked.