**Bug Description** Title: Safety classifier blocks execute_sql of a reviewed in-repo migration when called from a subagent What happened: - A Sonnet subagent called the Supabase MCP tool execute_sql with the exact content of a migration file already committed in the repo and security-reviewed (supabase/migrations/20261005190000_pro3675_placeholder_tables.sql, about 25 KB). - The call was blocked by the safety classifier. - The same SQL, sent once from the main session, ran without any block. -

[Bug] Safety classifier inconsistently blocks tool calls from subagents vs main session

Status Open

Reported on v2.1.289

Maintainer reply None cached

Activity 0 comments · opened Oct 6, 2026

Bug Description
Title: Safety classifier blocks execute_sql of a reviewed in-repo migration when called from a subagent

What happened:

A Sonnet subagent called the Supabase MCP tool execute_sql with the exact content of a migration file already committed in the repo and security-reviewed (supabase/migrations/20261005190000_pro3675_placeholder_tables.sql, about 25 KB).
The call was blocked by the safety classifier.
The same SQL, sent once from the main session, ran without any block.
Expected: the same reviewed statement is allowed or refused the same way whether a subagent or the main session sends it.

What the user said:

Repro:

Spawn a subagent with access to the Supabase MCP execute_sql tool.
Ask it to apply a large (about 25 KB) migration file from the repo to a development database.
Observe the classifier block.
Send the same SQL from the main session: it runs.

Impact:

Multi-agent workflows that delegate migration applies have to fall back to the main session.

Evidence:

Claude Code session on 2026-10-05 and 2026-10-06, project proplr_v1.
Migration versions 20261005190000 through 20261006170000 were all later applied from the main session without a block.

Environment Info