MCP servers you add to VS Code can run code on your machine, and a repository can carry its own MCP configuration. Review where each server comes from, keep secrets out of config files, and treat workspace MCP files like any other executable project file.
Local servers run code
The VS Code documentation warns that local MCP servers can run arbitrary code on your machine. Review the publisher and configuration before you start one, the same way you would review an extension. See what an extension can do for the comparable reasoning.
How trust works
- Servers in
.vscode/mcp.jsonand a workspace root.mcp.jsoninherit Workspace Trust. In a trusted workspace they start without a separate prompt. In Restricted Mode they are blocked. - Servers from other sources prompt on first start or after a configuration change. If you decline, the server does not start.
- MCP: Reset Trust resets those decisions without changing Workspace Trust.
So trusting a repository can start its MCP servers without another question. Read the MCP files before you trust.
The checklist
- Read the config location. Workspace files can be shared through source control, so a repository can introduce servers for everyone who opens it. User level files apply across workspaces.
- Review each server. Who publishes it, what command it runs, and what arguments and environment it receives.
- Keep secrets out. The documentation says to avoid hardcoding sensitive information like API keys. Use input variables or environment files.
- Consider sandboxing. On macOS and Linux you can set
sandboxEnabledand restrict file reads, file writes and network domains. The documentation notes that tool calls from a sandboxed server are auto approved, and that sandboxing is not available on Windows. - Check autostart. The default
newAndOutdatedsetting starts servers when you submit a chat message, including servers whose configuration changed. Settingchat.mcp.autostarttoneverdoes not stop a Copilot harness session from starting its configured servers. - Limit discovery. When discovery is enabled, VS Code can reuse server configurations from other applications and forward eligible ones to Copilot harness sessions.
- Think about sync. MCP server configs are one of the categories Settings Sync can copy. See what syncs.
- For teams. Organisations can control MCP access centrally through Copilot enterprise managed settings.
What to do on an unfamiliar repository
Stay in Restricted Mode, read .vscode/mcp.json and .mcp.json, and only then decide on trust.
An example of how it goes wrong
A repository includes a .vscode/mcp.json that defines a server which runs a package fetched at start time. A developer opens the repository, trusts the folder to get their tools working, and the server starts when they send their first chat message. The trust decision covered the whole folder, and the MCP file was part of it. Reading the file first would have taken one minute.
Where to go next
Treat MCP servers like dependencies: know who publishes them, pin what you can, and keep the list short. For a team, decide which servers are approved, where their configuration lives, and who may add one.
Quick check
Does Reset Trust change Workspace Trust?
No. The documentation says MCP: Reset Trust does not change Workspace Trust.
Is sandboxing a complete fix?
No. It limits file and network access on macOS and Linux, but it is unavailable on Windows and tool calls from the server are auto approved.
Sources
Last reviewed: 19 October 2026.
