diff --git a/codex-rs/mcp-server/BUILD.bazel b/codex-rs/mcp-server/BUILD.bazel
index f73561204e..5bf39611b9 100644
--- a/codex-rs/mcp-server/BUILD.bazel
+++ b/codex-rs/mcp-server/BUILD.bazel
@@ -3,7 +3,4 @@ load("//:defs.bzl", "codex_rust_crate")
 codex_rust_crate(
     name = "mcp-server",
     crate_name = "codex_mcp_server",
-    extra_binaries = [
-        "//codex-rs/bwrap:bwrap",
-    ],
 )
diff --git a/codex-rs/mcp-server/tests/suite/codex_tool.rs b/codex-rs/mcp-server/tests/suite/codex_tool.rs
index ebe77c147c..5cf8d71060 100644
--- a/codex-rs/mcp-server/tests/suite/codex_tool.rs
+++ b/codex-rs/mcp-server/tests/suite/codex_tool.rs
@@ -261,6 +261,10 @@ async fn patch_approval_triggers_elicitation() -> anyhow::Result<()> {
         .send_codex_tool_call(CodexToolCallParam {
             cwd: Some(cwd.path().to_string_lossy().to_string()),
             prompt: "please modify the test file".to_string(),
+            config: Some(HashMap::from([(
+                "sandbox_mode".to_string(),
+                json!("danger-full-access"),
+            )])),
             ..Default::default()
         })
         .await?;