Custom Internal App (MCP Server) Started Requesting Permission to Run All (read-only) Tool Calls

I have readOnlyHint true and destructiveHint false and have verified the tool annotations but it still requests permission every time. This is even after I have tried deleting/re-adding the connector/app.