diff --git a/codex-rs/app-server/src/request_processors.rs b/codex-rs/app-server/src/request_processors.rs
index f03351468fa..260759d3601 100644
--- a/codex-rs/app-server/src/request_processors.rs
+++ b/codex-rs/app-server/src/request_processors.rs
@@ -630,5 +630,42 @@ pub(crate) fn build_api_turns_from_rollout_items(items: &[RolloutItem]) -> Vec<T
             builder.handle_rollout_item(item);
         }
     }
-    builder.finish()
+    let turns = builder.finish();
+    if let Some(metrics) = codex_otel::global() {
+        for turn in &turns {
+            for item in &turn.items {
+                let ThreadItem::McpToolCall {
+                    server,
+                    app_context,
+                    mcp_app_resource_uri,
+                    plugin_id,
+                    ..
+                } = item
+                else {
+                    continue;
+                };
+                let has_mcp_app_resource_uri = mcp_app_resource_uri
+                    .as_deref()
+                    .is_some_and(|resource_uri| !resource_uri.is_empty());
+                let is_missing_trusted_connector_id = app_context
+                    .as_ref()
+                    .is_none_or(|context| context.connector_id.is_empty());
+                if has_mcp_app_resource_uri && is_missing_trusted_connector_id {
+                    let server_kind = if server == codex_mcp::CODEX_APPS_MCP_SERVER_NAME {
+                        "codex_apps"
+                    } else if plugin_id.is_some() {
+                        "selected_plugin"
+                    } else {
+                        "other"
+                    };
+                    let _ = metrics.counter(
+                        "codex.mcp.ui_resource_uri_without_trusted_connector_id",
+                        /*inc*/ 1,
+                        &[("server_kind", server_kind), ("source", "history")],
+                    );
+                }
+            }
+        }
+    }
+    turns
 }
diff --git a/codex-rs/core/src/mcp_tool_call.rs b/codex-rs/core/src/mcp_tool_call.rs
index d03f232d12b..f70421c022f 100644
--- a/codex-rs/core/src/mcp_tool_call.rs
+++ b/codex-rs/core/src/mcp_tool_call.rs
@@ -154,7 +154,31 @@ pub(crate) async fn handle_mcp_tool_call(
     )
     .await;
     let item_metadata = McpToolCallItemMetadata::from_tool_metadata(&server, metadata.as_ref());
-    let app_tool_policy = if server == CODEX_APPS_MCP_SERVER_NAME {
+    let is_codex_apps_server = server == CODEX_APPS_MCP_SERVER_NAME;
+    let has_mcp_app_resource_uri = item_metadata
+        .mcp_app_resource_uri
+        .as_deref()
+        .is_some_and(|resource_uri| !resource_uri.is_empty());
+    let is_missing_trusted_connector_id = item_metadata
+        .connector_id
+        .as_deref()
+        .is_none_or(str::is_empty);
+    // These calls cannot migrate from the deprecated top-level URI to appContext.resourceUri.
+    if has_mcp_app_resource_uri && is_missing_trusted_connector_id {
+        let server_kind = if is_codex_apps_server {
+            "codex_apps"
+        } else if manager.is_selected_plugin_mcp_server(&server) {
+            "selected_plugin"
+        } else {
+            "other"
+        };
+        turn_context.session_telemetry.counter(
+            "codex.mcp.ui_resource_uri_without_trusted_connector_id",
+            /*inc*/ 1,
+            &[("server_kind", server_kind), ("source", "live")],
+        );
+    }
+    let app_tool_policy = if is_codex_apps_server {
         let annotations = metadata
             .as_ref()
             .and_then(|metadata| metadata.annotations.as_ref());
@@ -174,7 +198,7 @@ pub(crate) async fn handle_mcp_tool_call(
     } else {
         AppToolPolicy::default()
     };
-    let approval_mode = if server == CODEX_APPS_MCP_SERVER_NAME {
+    let approval_mode = if is_codex_apps_server {
         app_tool_policy.approval
     } else if let Some(approval_mode) = {
         // Selected-plugin registrations are absent from config.toml and the legacy plugin manager,
@@ -196,7 +220,7 @@ pub(crate) async fn handle_mcp_tool_call(
         .as_ref()
         .and_then(|metadata| metadata.connector_name.clone());
 
-    if server == CODEX_APPS_MCP_SERVER_NAME && !app_tool_policy.enabled {
+    if is_codex_apps_server && !app_tool_policy.enabled {
         let result = notify_mcp_tool_call_skip(
             sess.as_ref(),
             turn_context.as_ref(),