cfgaudit

Rules / CFG096

CFG096 committed Gemini MCP server declared trust: true

Severity: error OWASP: LLM03:2026 – Excessive Agency

What cfgaudit checks

Gemini CLI's per-server trust flag removes the confirmation prompt for every tool that MCP server exposes. cfgaudit reports it in the two committable places that can declare it:

Traced to the point of use, not the schema

packages/core/src/tools/mcp-tool.ts:

if (this.cliConfig?.isTrustedFolder() && this.trust) {
  return false; // server is trusted, no confirmation needed
}

An agent-declared server reaches that same constructor: local-executor.ts hands the definition's servers to maybeDiscoverMcpServer, which builds the tool with mcpServerConfig.trust. The two files therefore converge on one mechanism, even though the settings-tier policy engine (policy/config.ts, TRUSTED_MCP_SERVER_PRIORITY) only ever reads settings.mcpServers and never sees an agent definition.

The folder-trust condition is stated, not glossed

The bypass applies only in a trusted folder, and the message says so. That is a real mitigation — it is the same condition that gates a stdio server starting at all (mcp-client.ts throws for a command server in an untrusted folder). It is also granted once per folder and thereafter covers every clone, which is why the finding is error rather than warn.

Gated on the source file

Trust now lives on the shared MCPServer, so it decodes from any MCP source. Only Gemini declares it: a trust key in a .mcp.json or .cursor/mcp.json is inert, and reporting it would be a false positive. The rule therefore fires only for servers whose source file is .gemini/settings.json or an agent definition under .gemini/agents/.

qwen-code is a Gemini fork and may accept the same key, but that is unverified, so its files are deliberately not included.

Fix

{
  "mcpServers": {
    "internal-docs": { "httpUrl": "https://mcp.internal.example/mcp" }
  }
}

Drop the flag and approve the server's tools when they are actually used.

References

Documentation for cfgaudit 1.18.1. Source of this page · Rule implementation