{"record":{"id":"5fb2931bb7c725c3","repo":"google-gemini/gemini-cli","slug":"configuration-untrusted-workspace-detected-stri","errorCode":null,"errorMessage":"[Configuration] Untrusted workspace detected. Stripping repository mcpServers definitions to prevent unintended command execution.","messagePattern":"\\[Configuration\\] Untrusted workspace detected\\. Stripping repository mcpServers definitions to prevent unintended command execution\\.","errorType":"console","errorClass":null,"httpStatus":null,"severity":"warning","filePath":"packages/a2a-server/src/config/config.ts","lineNumber":292,"sourceCode":"    : settings.checkpointing?.enabled;\n\n  if (checkpointing) {\n    if (!(await GitService.verifyGitAvailability())) {\n      logger.warn(\n        '[Config] Checkpointing is enabled but git is not installed. Disabling checkpointing.',\n      );\n      checkpointing = false;\n    }\n  }\n\n  const approvalMode =\n    getEnvLocal('GEMINI_YOLO_MODE') === 'true'\n      ? ApprovalMode.YOLO\n      : ApprovalMode.DEFAULT;\n\n  if (!trusted) {\n    if (settings.mcpServers) {\n      logger.warn(\n        '[Configuration] Untrusted workspace detected. Stripping repository mcpServers definitions to prevent unintended command execution.',\n      );\n    }\n    if (settings.policyPaths) {\n      logger.warn(\n        '[Configuration] Untrusted workspace detected. Stripping repository policyPaths definitions to prevent unintended policy override.',\n      );\n    }\n    if (settings.adminPolicyPaths) {\n      logger.warn(\n        '[Configuration] Untrusted workspace detected. Stripping repository adminPolicyPaths definitions to prevent unintended admin policy override.',\n      );\n    }\n    if (settings.tools) {\n      logger.warn(\n        '[Configuration] Untrusted workspace detected. Stripping repository tools definitions to prevent unintended tool enablement.',\n      );\n    }","sourceCodeStart":274,"sourceCodeEnd":310,"githubUrl":"https://github.com/google-gemini/gemini-cli/blob/0bd1d439751478771c45d3d0895a6a9760554bf4/packages/a2a-server/src/config/config.ts#L274-L310","documentation":"This is a security warning emitted by loadConfig in the a2a-server. When the workspace is not marked as trusted, any mcpServers defined in project settings are stripped so a cloned repository cannot make the server spawn arbitrary MCP commands. The config still loads; only the repository-supplied mcpServers are ignored.","triggerScenarios":"Calling loadConfig with trusted=false (the default) while the settings object contains a mcpServers key — e.g. when the caller did not pass trusted=true or the workspace trust flag (folderTrust / GEMINI_FOLDER_TRUST) is not enabled.","commonSituations":"Cloning a repo with a project-level .gemini/settings.json containing mcpServers and running the a2a server inside it; running in CI or a container where workspace trust was never granted; GEMINI_FOLDER_TRUST not exported in the environment.","solutions":["Trust the workspace by starting the server with folder trust enabled (settings.folderTrust=true or GEMINI_FOLDER_TRUST=true and passing trusted=true to loadConfig)","Move the mcpServers definitions from the project settings to user-level (global) settings, which are not stripped","If the mcpServers are not needed, remove them from the repository settings file to silence the warning","Accept the warning: it is informational; the server continues with mcpServers disabled"],"exampleFix":"// before (project .gemini/settings.json used in untrusted workspace)\n{ \"mcpServers\": { \"fs\": { \"command\": \"npx\", \"args\": [\"-y\", \"@modelcontextprotocol/server-fs\"] } } }\n// after (enable trust via env before launching)\nexport GEMINI_FOLDER_TRUST=true\n// or in user-level settings.json (not stripped):\n{ \"folderTrust\": true, \"mcpServers\": { \"fs\": { \"command\": \"npx\", \"args\": [\"-y\", \"@modelcontextprotocol/server-fs\"] } } }","handlingStrategy":"validation","validationCode":"// Run before calling loadConfig; ensure trust or absence of repo mcpServers\nimport { getEnv } from './config';\nexport function assertMcpServersSurvive(settings: { mcpServers?: unknown; folderTrust?: boolean }): void {\n  const trusted = settings.folderTrust === true || getEnv('GEMINI_FOLDER_TRUST') === 'true';\n  if (!trusted && settings.mcpServers) {\n    throw new Error('Workspace is untrusted: repository mcpServers will be stripped. Enable folderTrust or move mcpServers to user settings.');\n  }\n}","typeGuard":"function isTrustedWorkspace(s: { folderTrust?: boolean }): boolean {\n  return s.folderTrust === true || process.env['GEMINI_FOLDER_TRUST'] === 'true';\n}","tryCatchPattern":null,"preventionTips":["Set GEMINI_FOLDER_TRUST=true only for workspaces you control","Keep mcpServers definitions in user-level settings, not repo settings","Log the warning output of loadConfig in CI to detect stripped config","Never trust a freshly cloned repository's project settings"],"tags":["security","configuration","workspace-trust","mcp"],"backgroundTag":"untrusted-workspace-settings-stripped","analyzedSha":"0bd1d439751478771c45d3d0895a6a9760554bf4","analyzedAt":"2026-09-01T05:28:28.590Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}