Public story · 2026-08-29 · source-backed

gemini-cli made workspace trust fail-closed and filters `mcpServers` in restricted mode.

Issue

2026-08-29

Confidence

source-backed

Sources

Redaction

redacted

Story

PR #29099 means an untrusted directory can no longer hand the agent its own MCP server list. The previous behavior was that a trust-check failure produced a trusted workspace, which is the worst possible default. Two nightlies earlier, #29081 fixed SSRF in MCP OAuth metadata discovery and authentication. (GitHub)

OpenAI Agents SDK supports MCP / Shared entities / Same source domain / Earlier coverage
Pipelock — Single-Binary Firewall for AI Agents (128 stars, 20 days old)
Linked by a graph relationship (OpenAI Agents SDK supports MCP); both cover GitHub, MCP, SSRF; reported by the same outlet (github.com).
Codex uses MCP / Shared entities / Same source domain / Shared topic / Earlier coverage
wmux now refuses browser-automation calls that don't name their workspace.
Linked by a graph relationship (Codex uses MCP); both cover GitHub, MCP; reported by the same outlet (github.com).
Claude uses MCP / Shared entities / Same source domain / Shared topic / Earlier coverage
Claude's plugin marketplace passes 200.
Linked by a graph relationship (Claude uses MCP); both cover GitHub, MCP; reported by the same outlet (github.com).
Claude Code uses MCP / Shared entities / Same source domain / Shared topic / Earlier coverage
The Code Editor Is Dead. Three Platforms Buried It in the Same Week.
Linked by a graph relationship (Claude Code uses MCP); both cover GitHub, MCP; reported by the same outlet (github.com).
Claude uses MCP / Shared entities / Same source domain / Shared topic / Earlier coverage
hexstrike-ai — 150+ Security Tools as MCP Server (6,895 stars)
Linked by a graph relationship (Claude uses MCP); both cover GitHub, MCP; reported by the same outlet (github.com).
Google released MCP / Shared entities / Same source domain / Earlier coverage / Tension
Agent Plugins 1.0 went GA — and a lab outside the authoring group shipped support the same week
Linked by a graph relationship (Google released MCP); both cover GitHub, MCP; reported by the same outlet (github.com).
Cursor uses MCP / Shared entities / Same source domain / Earlier coverage / Tension
agentmemory puts a dollar figure on memory architecture: ~$10/year vs ~$500/year.
Linked by a graph relationship (Cursor uses MCP); both cover GitHub, MCP; reported by the same outlet (github.com).
Codex uses MCP / Shared entities / Same source domain / Earlier coverage / Tension
The Claude Code Field Guide Hit 53,400 Stars. Here's Why That Matters.
Linked by a graph relationship (Codex uses MCP); both cover GitHub, MCP; reported by the same outlet (github.com).

Source trail

google-gemini/gemini-cli More from github.com

Entities

GitHub MCP MCP OAuth SSRF

Provenance

Canonical issue: Ramsay Research Agent — August 29, 2026
AI generated: no
Story unit: 2026-08-29-gemini-cli-made-workspace-trust-fail-closed-and-filters-mcpservers-in-restricted-mode
Labels: source-backed, canonical briefing excerpt

Fetching from the wire…

gemini-cli made workspace trust fail-closed and filters `mcpServers` in restricted mode.

Story

Related stories

Pipelock — Single-Binary Firewall for AI Agents (128 stars, 20 days old)

wmux now refuses browser-automation calls that don't name their workspace.

Claude's plugin marketplace passes 200.

The Code Editor Is Dead. Three Platforms Buried It in the Same Week.

hexstrike-ai — 150+ Security Tools as MCP Server (6,895 stars)

Agent Plugins 1.0 went GA — and a lab outside the authoring group shipped support the same week

agentmemory puts a dollar figure on memory architecture: ~$10/year vs ~$500/year.

The Claude Code Field Guide Hit 53,400 Stars. Here's Why That Matters.

Source trail

Entities

Provenance

gemini-cli made workspace trust fail-closed and filters `mcpServers` in restricted mode.

Story

Related stories

Pipelock — Single-Binary Firewall for AI Agents (128 stars, 20 days old)

wmux now refuses browser-automation calls that don't name their workspace.

Claude's plugin marketplace passes 200.

The Code Editor Is Dead. Three Platforms Buried It in the Same Week.

hexstrike-ai — 150+ Security Tools as MCP Server (6,895 stars)

Agent Plugins 1.0 went GA — and a lab outside the authoring group shipped support the same week

agentmemory puts a dollar figure on memory architecture: ~$10/year vs ~$500/year.

The Claude Code Field Guide Hit 53,400 Stars. Here's Why That Matters.

Source trail

Entities

Provenance