Gemini CLI fix: corrupt MCP enablement config silently re-enables all disabled servers
lets-order-some-fries · ghdev · 2026-09-22
PR #29445 on google-gemini/gemini-cli fixes a fail-open trust boundary: when mcp-server-enablement. exists but is unreadable, readConfig() collapsed "missing" and "corrupt" into {}, and isFileEnabled() defaults empty configs to enabled (?? true) — so every MCP server the user disabled gets reported as enabled with its tools exposed to the model. The next disable() then overwrites the corrupt file with a one-entry fresh file, erasing all other entries.
The fix:
- readConfig() returns a discriminated ok/missing/unreadable result; only missing yields an empty config
- isFileEnabled() fails closed on unreadable
- enable()/disable() refuse to write on unreadable configs, throwing McpServerEnablementConfigError so the on-disk file is preserved
- Malformed-shape but valid JSON is treated as unreadable; unknown extra fields are still accepted for backward compatibility
- Errors are reported once per stretch of failures, naming the file path and remedy
More from coding & agent
- Pigment Agents now reads and posts in Slack, inheriting user permissions — mattturck · 2026-11-12
- Map of the agent economy: 50+ startups across payments, spend control, identity, memory — venturetwins · 2026-11-12
- OpenCode launches Browse, an on-device browser agent with local logins — Saul_Loveman · 2026-11-12
- VentureTwins maps the B2A economy: dozens of agent infra and app companies in first series installment — venturetwins · 2026-11-12
- Google releases 76-page 'Agents Companion' whitepaper on agent engineering — mdancho84 · 2026-11-12
- Spinning up containers for 20-line agent tools is backwards: Safescript compiles provable, 50ms-deploy apps — uriwa · 2026-11-12