Read-only Codex starts your MCP servers too. Disable them before the review.

A codex exec -s read-only review can't write files, and the MCP servers in your ~/.codex/config.toml start for it anyway. A server that can change things outside the sandbox works against a read-only