# load_mcp_server_trust_lists

> **Function** in `deepagents_code`

📖 [View in docs](https://reference.langchain.com/python/deepagents-code/model_config/load_mcp_server_trust_lists)

Load per-server project MCP allow/deny lists from user-level config.

Security boundary: this reads the `[mcp]` table only from the user-level
`config.toml` (`DEFAULT_CONFIG_PATH`, i.e. `~/.deepagents/config.toml`) and
the `DEEPAGENTS_CODE_DANGEROUSLY_ENABLE_PROJECT_MCP_SERVERS` /
`DEEPAGENTS_CODE_DISABLED_PROJECT_MCP_SERVERS` process env vars — never from
a project's `.mcp.json` or any repo-committed file. There is no
project-level `config.toml` discovery, so an attacker who commits a
malicious `.mcp.json` plus an in-repo config cannot pre-approve their own
servers; the approval must live in the user's home config. This mirrors
Claude Code's "untrusted folder → only non-checked-in settings" rule.

Source resolution differs by list, matching each one's security direction:

- `enabled` (permissive): the env var is an explicit process-wide name
    allowlist.
- `approvals` (permissive): TOML approvals bind fixed remote URLs to one
    validated local Git repository (shared across its worktrees). Local commands
    and interpolated remote URLs bind to an exact worktree. All include a
    server-definition fingerprint and remain active alongside env-enabled names,
    so setting the process-wide escape hatch does not discard choices remembered
    by the interactive prompt.
    Legacy flat TOML
    `enabled_project_servers` entries are ignored because they cannot be safely
    scoped.
- `disabled` (restrictive): the env var *unions* with the TOML list — denies
    accumulate and a lower-effort source can never silently empty a deny
    entry set in the other, which would be a fail-open. There is
    deliberately no way to *remove* a configured deny via env.

Rejection wins: a name appearing in approval and disabled data is reported
only in `disabled`.

## Signature

```python
load_mcp_server_trust_lists(
    config_path: Path | None = None,
) -> McpServerTrustLists
```

## Parameters

| Name | Type | Required | Description |
|------|------|----------|-------------|
| `config_path` | `Path \| None` | No | Config file to read. Defaults to `DEFAULT_CONFIG_PATH`; callers should not point this at a project path — doing so would defeat the boundary above. (default: `None`) |

## Returns

`McpServerTrustLists`

The resolved `McpServerTrustLists`. A missing file yields empty lists
(the normal "unset" case). `read_error` is set (so callers can fail
closed instead of treating a broken config as "nothing denied") when
the file exists but cannot be read/parsed, when `[mcp]` is not a
table, or when `disabled_project_servers` is a wrong type that cannot
be read as a deny list; env-sourced names still apply in that case.

---

[View source on GitHub](https://github.com/langchain-ai/deepagents/blob/7794b61a6e76230e8c7a49bdce808b3728305914/libs/code/deepagents_code/model_config.py#L4025)