load_mcp_server_trust_lists

Load per-server project MCP allow/deny lists from user-level config.

Security boundary: this reads the [mcp] table only from the user-level config.toml (DEFAULT_CONFIG_PATH, i.e. ~/.deepagents/config.toml) and the DEEPAGENTS_CODE_DANGEROUSLY_ENABLE_PROJECT_MCP_SERVERS / DEEPAGENTS_CODE_DISABLED_PROJECT_MCP_SERVERS process env vars — never from a project's .mcp.json or any repo-committed file. There is no project-level config.toml discovery, so an attacker who commits a malicious .mcp.json plus an in-repo config cannot pre-approve their own servers; the approval must live in the user's home config. This mirrors Claude Code's "untrusted folder → only non-checked-in settings" rule.

Source resolution differs by list, matching each one's security direction:

• managed config (highest precedence): an administrator [mcp] table outranks every source below. An explicit managed enabled_project_server_approvals list replaces both the env-enabled names and the user's remembered approvals. Managed denies union with the rest.
• enabled (permissive): the env var is an explicit process-wide name allowlist.
• approvals (permissive): TOML approvals bind fixed remote URLs to one validated local Git repository (shared across its worktrees). Local commands and interpolated remote URLs bind to an exact worktree. All include a server-definition fingerprint and remain active alongside env-enabled names, so setting the process-wide escape hatch does not discard choices remembered by the interactive prompt. An explicit managed approvals list is the one exception: it replaces both. Legacy flat TOML enabled_project_servers entries are ignored because they cannot be safely scoped.
• disabled (restrictive): the env var unions with the TOML list — denies accumulate and a lower-effort source can never silently empty a deny entry set in the other, which would be a fail-open. There is deliberately no way to remove a configured deny via env.

Rejection wins: a name appearing in approval and disabled data is reported only in disabled.