A project folder can do more than hold code. In an agent workflow it can also describe servers to start, policies to load, tools to enable and places to send telemetry. Gemini CLI’s merged workspace-trust change makes one boundary explicit: when the environment says the workspace is restricted or untrusted, those repository-supplied settings must not make the trip into the A2A server’s startup configuration.
The first reading was too small: filter an MCP configuration and move on. The final main-branch diff filters five families when the A2A server is not trusted: mcpServers, policy paths, admin-policy paths, tool settings and telemetry. That matters because each family is a different claim by a checkout about what an agent should execute, permit or report.
Trust has to win before configuration is assembled
At the core, the change makes an explicit GEMINI_RESTRICTED_MODE=true or an explicit false workspace-trust signal win before folder or IDE fallbacks. The A2A loader then creates a safe view of the repository settings rather than mutating the caller’s original object. Its new tests assert that the server sees none of those configuration families when trust is false—and that it keeps them when trust is true.
The pull request’s public review trail explains why the distinction grew. Early review findings did not stop at MCP servers: policy paths, admin-policy paths and tools could also let a repository influence the server’s authority. The merged version strips all of them, plus telemetry. That is a more useful security shape than a single blacklist: decide whether the workspace is trusted, then keep its startup instructions out of the privileged path until it is.
The next audit question is concrete
For a maintainer or operator, this turns “do we trust this project?” into a testable question: can an untrusted checkout cause any repository-defined server, policy, tool or telemetry route to be active before an explicit trust decision? The public receipts show intended main-branch behavior, not a shipped release, a complete audit or every Gemini CLI execution path. The signal to watch is release guidance—and tests beyond this A2A path—that make the same answer visible wherever a project can shape an agent runtime.