{"version":"2.1.238","anchor":"agents-in-untrusted-folders-can-no-longer-define-inline-mcp-","canonical_anchor":"agents-in-untrusted-folders-can-no-longer-define-inline-mcp-","heading":"Agents in untrusted folders can no longer define inline MCP servers","tier":"notice","area":"MCP","scope":null,"heads_up":null,"url":"https:\/\/changelogs.core-directive.com\/v\/2.1.238\/e\/agents-in-untrusted-folders-can-no-longer-define-inline-mcp-","release_url":"https:\/\/changelogs.core-directive.com\/v\/2.1.238","markdown":"### Agents in untrusted folders can no longer define inline MCP servers\n\nAgents in untrusted folders can no longer define inline MCP servers; trust the project to allow it.\n\n**What**\n\nIf an agent's frontmatter declares MCP servers inline rather than by name, and the folder the agent is defined in is not trusted, those servers are now dropped for both the main thread and subagents. A log names the source and tells you to accept the trust dialog or set `hasTrustDialogAccepted`. There is no flag: this applies to anyone whose agent files live outside a trusted project.\n\n**Details**\n\n- Only inline (non-string) server definitions are affected; agents that reference servers by name are unchanged.\n- The existing untrusted-origin telemetry event gained a `what` field distinguishing `\"hooks\"` from `\"mcpServers\"`.\n- The warning is deduplicated per agent and surface, so it is logged only the first time.\n\n**Evidence**\n\n`tengu_agent_hooks_origin_untrusted`\n\n- Area: MCP\n- Names: `hasTrustDialogAccepted`\n- Tier: You'll notice\n- Useful: 4\/5\n- Signal: 3\/5"}