Why it matters
TrustFall shows how project-defined MCP configuration can turn a generic “trust this folder” decision into unsandboxed command execution in several coding agents, with zero-click variants in unattended CI. The vendor-authored research traces the issue to conflating permission to read or edit a workspace with permission to start repository-supplied executables.
My takeaway: Default-deny project MCP servers and require a separate approval that shows the exact executable, arguments, and resolved path. Reject agent configuration from untrusted pull requests, sandbox headless jobs, remove production secrets, and keep workspace access distinct from code-execution trust.