[Configuration] Untrusted workspace detected. Stripping repo

Error message

[Configuration] Untrusted workspace detected. Stripping repository mcpServers definitions to prevent unintended command execution.

What it means

This is a security warning emitted by loadConfig in the a2a-server. When the workspace is not marked as trusted, any mcpServers defined in project settings are stripped so a cloned repository cannot make the server spawn arbitrary MCP commands. The config still loads; only the repository-supplied mcpServers are ignored.

Source

Thrown at packages/a2a-server/src/config/config.ts:292

    : settings.checkpointing?.enabled;

  if (checkpointing) {
    if (!(await GitService.verifyGitAvailability())) {
      logger.warn(
        '[Config] Checkpointing is enabled but git is not installed. Disabling checkpointing.',
      );
      checkpointing = false;
    }
  }

  const approvalMode =
    getEnvLocal('GEMINI_YOLO_MODE') === 'true'
      ? ApprovalMode.YOLO
      : ApprovalMode.DEFAULT;

  if (!trusted) {
    if (settings.mcpServers) {
      logger.warn(
        '[Configuration] Untrusted workspace detected. Stripping repository mcpServers definitions to prevent unintended command execution.',
      );
    }
    if (settings.policyPaths) {
      logger.warn(
        '[Configuration] Untrusted workspace detected. Stripping repository policyPaths definitions to prevent unintended policy override.',
      );
    }
    if (settings.adminPolicyPaths) {
      logger.warn(
        '[Configuration] Untrusted workspace detected. Stripping repository adminPolicyPaths definitions to prevent unintended admin policy override.',
      );
    }
    if (settings.tools) {
      logger.warn(
        '[Configuration] Untrusted workspace detected. Stripping repository tools definitions to prevent unintended tool enablement.',
      );
    }

View on GitHub (pinned to 0bd1d43975)

Solutions

Trust the workspace by starting the server with folder trust enabled (settings.folderTrust=true or GEMINI_FOLDER_TRUST=true and passing trusted=true to loadConfig)
Move the mcpServers definitions from the project settings to user-level (global) settings, which are not stripped
If the mcpServers are not needed, remove them from the repository settings file to silence the warning
Accept the warning: it is informational; the server continues with mcpServers disabled

Example fix

// before (project .gemini/settings.json used in untrusted workspace)
{ "mcpServers": { "fs": { "command": "npx", "args": ["-y", "@modelcontextprotocol/server-fs"] } } }
// after (enable trust via env before launching)
export GEMINI_FOLDER_TRUST=true
// or in user-level settings.json (not stripped):
{ "folderTrust": true, "mcpServers": { "fs": { "command": "npx", "args": ["-y", "@modelcontextprotocol/server-fs"] } } }

Defensive patterns

Strategy: validation

Validate before calling

// Run before calling loadConfig; ensure trust or absence of repo mcpServers
import { getEnv } from './config';
export function assertMcpServersSurvive(settings: { mcpServers?: unknown; folderTrust?: boolean }): void {
  const trusted = settings.folderTrust === true || getEnv('GEMINI_FOLDER_TRUST') === 'true';
  if (!trusted && settings.mcpServers) {
    throw new Error('Workspace is untrusted: repository mcpServers will be stripped. Enable folderTrust or move mcpServers to user settings.');
  }
}

Type guard

function isTrustedWorkspace(s: { folderTrust?: boolean }): boolean {
  return s.folderTrust === true || process.env['GEMINI_FOLDER_TRUST'] === 'true';
}

Prevention

Set GEMINI_FOLDER_TRUST=true only for workspaces you control
Keep mcpServers definitions in user-level settings, not repo settings
Log the warning output of loadConfig in CI to detect stripped config
Never trust a freshly cloned repository's project settings

When it happens

Trigger: Calling loadConfig with trusted=false (the default) while the settings object contains a mcpServers key — e.g. when the caller did not pass trusted=true or the workspace trust flag (folderTrust / GEMINI_FOLDER_TRUST) is not enabled.

Common situations: Cloning a repo with a project-level .gemini/settings.json containing mcpServers and running the a2a server inside it; running in CI or a container where workspace trust was never granted; GEMINI_FOLDER_TRUST not exported in the environment.

Related errors

AI-assisted analysis of google-gemini/gemini-cli@0bd1d43975 (2026-09-01). Data as JSON: /api/errors/5fb2931bb7c725c3. Report an issue: GitHub.