A repository can include files that change how an AI coding agent behaves: instructions, settings, hooks and MCP server definitions. Agents therefore show a workspace trust prompt for folders you have not trusted before. Treat that prompt like opening a script from the internet, and read it before you accept.
Definitions
Workspace trust. A dialog that asks whether you trust the code and config in a folder before the tool acts on it.
Project MCP config. A file in the repository that lists MCP servers to start. Claude Code's documentation says project-scoped servers live in a file named .mcp.json and have their own approval prompt.
Hook. A command the tool runs at defined moments, such as before a tool call.
What a repository can influence
| Item | Effect | Risk |
|---|---|---|
| Instruction files | Shape what the agent does | Hidden instructions steer it |
| Project settings | Permissions, hooks | Looser rules than you intended |
| MCP server list | Adds tools, may launch local commands | Code execution and data access |
| Scripts the agent runs | Build and test commands | Anything in them executes |
Documentation for Claude Code also notes that servers can come from other scopes, connectors and plugins, so reviewing the project file alone does not show every server a session can load.
What the documentation says about trust
In an interactive Claude Code session, a trust dialog appears when you start in a folder you have not trusted. Servers in a project's MCP file get their own prompt. The documentation warns that non-interactive sessions started with a print flag show neither prompt, and it points to a page listing what a repository's files can run before you trust a folder. If you start in your home directory, trust is held for that session only.
Other tools have their own behavior. Check theirs rather than assuming the same.
A safe routine
- Do not run an agent in an unknown repo on your main machine. Use a throwaway virtual machine or dev container for code you have not read.
- Read the config first. Open the settings, instruction and MCP files in a plain editor before starting the agent.
- Decline servers you do not recognize. Approve one at a time.
- Keep permissions strict in an unfamiliar repo. Avoid modes that skip approvals.
- Keep secrets out of the environment. Start the session in a shell without cloud credentials loaded.
- Be careful in automation. Non-interactive runs may skip prompts, so run them only on code you control.
- Review diffs before committing and never let the agent push straight to a protected branch.
Quick check
Is cloning a repository itself dangerous?
Cloning only copies files. The risk starts when a tool executes or acts on what is in them, which is why trust prompts appear when you open the folder with an agent.
Can a pull request from a stranger change agent config?
Yes, if the repository keeps config in tracked files. Review changes to those files like changes to build scripts.
Do trust prompts protect me in headless mode?
Not per the Claude Code documentation: print-mode sessions show neither prompt. Only run those on repositories you trust.
Where Safeguard fits
Safeguard scans repositories for vulnerable and risky dependencies and applies policies and gates to pull requests that change agent configuration. A free scan is at gold.safeguard.sh/scan.
Sources
Last reviewed: 19 October 2026.
