Gemini CLI stops loading repository MCP servers in an untrusted workspace

Trust in an agent tool is not a label on a folder. It decides which files are read, which tools are exposed, and which processes get spawned. This fix moves that decision earlier and makes its failure mode a refusal rather than a fallback.

What changed in the trust check

In the core trust utility, the check now evaluates GEMINI_RESTRICTED_MODE, GEMINI_FOLDER_TRUST and GEMINI_CLI_TRUST_WORKSPACE before it looks at the local option that enables folder trust. When one of those signals says the environment is untrusted, the function returns an untrusted result at once, with the source recorded as the environment.

The configuration layer follows the same order. Untrusted environment variables are evaluated early, so the folder check returns false before any stored context or fallback is consulted. Components that ask whether the folder is trusted now get the answer the environment intended, not the one a fallback produced.

Why dropping the server definitions matters

A repository can carry its own MCP server definitions in configuration a person never opens. Those definitions describe processes the agent launches, so a definition that survives an untrusted-workspace check is a way to run code by being cloned and opened.

In the A2A server the configuration loader now checks the trusted argument, and when the workspace is not trusted it strips the repository-scoped MCP server definitions before they reach policy settings or configuration parameters. The pull request adds a test suite for the trust resolution, the fail-closed behavior and the filtering.

What this is, and what it is not

This is a hardening change, not a response to a published vulnerability. No advisory accompanies it, and the pull request describes the behavior as unintended rather than exploited.

It is also, for now, only in a nightly build. Anyone tracking the stable channel gets it when the 0.59 line is released, and until then the change exists for people who follow nightly builds on purpose.