McpServerTrustLists

Env-sourced server names pre-approved for any project config.

Server names always rejected; reject wins over approvals and over trust.

Non-None when the user's config.toml existed but its trust policy could not be fully read: the file was unreadable/unparseable, its [mcp] value was not a table, or its disabled_project_servers was a wrong type that could not be interpreted as a deny list. Callers must treat this as fail-closed (do not grant whole-config project trust) and surface it, rather than proceeding with a deny list that may not have loaded — use load_failed for that check. Note the resolved enabled/disabled sets are not necessarily empty here: names from a still-readable source (the env vars) continue to apply. Excluded from equality so a failed load still compares equal to empty lists for tests that only care about the resolved names.

Project-scoped approvals loaded from user config.toml.

Names found in a legacy [mcp].enabled_project_servers list that this build no longer honors. Non-empty means the user relied on the removed flat allowlist, so those servers silently stopped loading; callers should surface it (a bare logger.warning is invisible outside debug mode) so non-interactive paths can explain the change. Diagnostic, not resolved policy — excluded from equality like read_error.

True when the removed DEEPAGENTS_CODE_ENABLED_PROJECT_MCP_SERVERS env var is set. It was renamed to the DANGEROUSLY_-prefixed var and is no longer read, so its names silently stopped pre-approving. The diagnostic twin of legacy_ignored for the env surface; callers should surface the rename so the change is not silent. Excluded from equality like read_error.

Count of [mcp].enabled_project_server_approvals rows that were dropped as malformed (wrong-typed key, non-table entry, a table missing/blank project_root/name/fingerprint, or an invalid Git identity marker). Non-zero means a persisted approval could not be read, so its server silently re-prompts; callers should surface it (a bare logger.warning is invisible outside debug mode) for parity with legacy_ignored. Diagnostic, not resolved policy — excluded from equality.

Whether the user's trust policy failed to load (see read_error).

Callers gating on trust MUST check this and fail closed: a failed load means a configured deny may be missing, so whole-config project trust must not be honored. Named so the fail-closed contract is discoverable rather than resting on every caller remembering the read_error sentinel.

Return whether server is approved by name or scoped fingerprint.