[Configuration] Untrusted workspace detected. Stripping repo

Error message

[Configuration] Untrusted workspace detected. Stripping repository tools definitions to prevent unintended tool enablement.

What it means

Security warning from loadConfig: when the workspace is not trusted, repository-defined tools settings (core/exclude/allowed tool lists) are stripped so a cloned repo cannot enable or disable tools. Loading proceeds; the repo's tools configuration is ignored.

Source

Thrown at packages/a2a-server/src/config/config.ts:307

  if (!trusted) {
    if (settings.mcpServers) {
      logger.warn(
        '[Configuration] Untrusted workspace detected. Stripping repository mcpServers definitions to prevent unintended command execution.',
      );
    }
    if (settings.policyPaths) {
      logger.warn(
        '[Configuration] Untrusted workspace detected. Stripping repository policyPaths definitions to prevent unintended policy override.',
      );
    }
    if (settings.adminPolicyPaths) {
      logger.warn(
        '[Configuration] Untrusted workspace detected. Stripping repository adminPolicyPaths definitions to prevent unintended admin policy override.',
      );
    }
    if (settings.tools) {
      logger.warn(
        '[Configuration] Untrusted workspace detected. Stripping repository tools definitions to prevent unintended tool enablement.',
      );
    }
    if (settings.telemetry) {
      logger.warn(
        '[Configuration] Untrusted workspace detected. Stripping repository telemetry definitions to prevent unintended data routing.',
      );
    }
    settings = {
      ...settings,
      mcpServers: undefined,
      policyPaths: undefined,
      adminPolicyPaths: undefined,
      tools: undefined,
      telemetry: undefined,
    };
  }
  const safeMcpServers = settings.mcpServers;

View on GitHub (pinned to 0bd1d43975)

Solutions

Enable workspace trust (settings.folderTrust=true or GEMINI_FOLDER_TRUST=true and trusted=true on loadConfig)
Move the tools configuration to user-level/global settings, which are not stripped
Remove repo-level tools settings if not required
Accept the warning: the server runs with default tool configuration

Example fix

// before
// untrusted workspace + project settings: { "tools": { "core": ["write_file"] } } -> stripped
// after
export GEMINI_FOLDER_TRUST=true
// or user-level settings:
{ "folderTrust": true, "tools": { "core": ["write_file"] } }

Defensive patterns

Strategy: validation

Validate before calling

export function assertToolsSurvive(settings: { tools?: unknown; folderTrust?: boolean }): void {
  const trusted = settings.folderTrust === true || process.env['GEMINI_FOLDER_TRUST'] === 'true';
  if (!trusted && settings.tools) {
    throw new Error('Workspace is untrusted: repository tools configuration will be stripped. Enable folderTrust or move tools config to user settings.');
  }
}

Type guard

function isTrustedWorkspace(s: { folderTrust?: boolean }): boolean {
  return s.folderTrust === true || process.env['GEMINI_FOLDER_TRUST'] === 'true';
}

Prevention

Place tools allow/exclude lists in user-level settings
Enable folder trust deliberately per workspace
Diff effective tool config against expectations after loadConfig
Do not enable trust automatically for cloned repos

When it happens

Trigger: loadConfig called with trusted=false while settings.tools exists in project settings; workspace trust not granted (folderTrust/GEMINI_FOLDER_TRUST not set).

Common situations: Cloned repo ships tools allowlists in project settings; running in a sandbox/CI where trust was never granted; after enabling folder-trust enforcement, previously working tool enablement silently stops.

Related errors

AI-assisted analysis of google-gemini/gemini-cli@0bd1d43975 (2026-09-01). Data as JSON: /api/errors/fc5cf4a3d253410f. Report an issue: GitHub.