Use consolidated MCP server lists in the ACP and policy-engine paths

[adilburaksen]

Summary

#27377 fixed an MCP allow/block list bypass by adding getConsolidatedExcludedMcpServers() / getConsolidatedAllowedMcpServers() (which union mcp.excluded and intersect mcp.allowed across all settings scopes, so a workspace-scoped setting cannot drop a user/system entry via the default REPLACE merge). Those were wired into the interactive loadCliConfig path and mcp list.

Two call paths still read the raw, workspace-overridable mcp.excluded / mcp.allowed:

1. ACP path — acpSessionManager called loadCliConfig(..., { cwd }) without loadedSettings, so loadCliConfig fell back to settings.mcp?.excluded / settings.mcp?.allowed (raw merged, REPLACE). A workspace .gemini/settings.json with mcp.excluded: [] therefore dropped a user-level block when running under ACP (e.g. in an editor), allowing an MCP server the user had blocked to connect.
2. Policy engine — effectiveSettings.mcp (passed to createPolicyEngineConfig) used raw settings.mcp?.allowed and inherited raw settings.mcp?.excluded, so the generated DENY/ALLOW policy rules were also workspace-overridable.

Change

• acpSessionManager now passes loadedSettings: currentSettings to loadCliConfig, matching the interactive path, so blockedMcpServers / allowedMcpServers use the consolidated lists.
• effectiveSettings.mcp now uses getConsolidatedAllowedMcpServers() / getConsolidatedExcludedMcpServers() when loadedSettings is available, so the policy engine's MCP rules use the consolidated lists too.

This makes system- and user-scoped MCP blocks consistent across the interactive, ACP, and policy-engine paths.

[gemini-code-assist]

Summary of Changes

Hello, I'm Gemini Code Assist¹! I'm currently reviewing this pull request and will post my feedback shortly. In the meantime, here's a summary to help you and other reviewers quickly get up to speed!

This pull request addresses a security vulnerability where workspace-specific settings could inadvertently bypass user or system-level MCP server blocks. By ensuring that both the ACP session manager and the policy engine utilize consolidated MCP server lists, the changes enforce consistent security policies across all execution paths.

Highlights

• ACP Session Manager Update: Updated acpSessionManager to pass loadedSettings to loadCliConfig, ensuring that the ACP path consistently uses consolidated MCP server lists.
• Policy Engine Security: Modified loadCliConfig to utilize consolidated allowed and excluded MCP server lists, preventing workspace-scoped settings from overriding user or system-level security blocks.

Using Gemini Code Assist

The full guide for Gemini Code Assist can be found on our documentation page, here are some quick tips.

Invoking Gemini

You can request assistance from Gemini at any point by creating a comment using either /gemini <command> or @gemini-code-assist <command>. Below is a summary of the supported commands on the current page.

Feature	Command	Description
Code Review	/gemini review	Performs a code review for the current pull request in its current state.
Pull Request Summary	/gemini summary	Provides a summary of the current pull request in its current state.
Comment	@gemini-code-assist	Responds in comments when explicitly tagged, both in pull request comments and review comments.
Help	/gemini help	Displays a list of available commands.

Customization

To customize the Gemini Code Assist for GitHub experience, repository maintainers can create a configuration file and/or provide a custom code review style guide (such as PEP-8 for Python) by creating and adding files to a .gemini/ folder in the base of the repository. Detailed instructions can be found here.

Limitations & Feedback

Gemini Code Assist may make mistakes. Please leave feedback on any instances where its feedback is incorrect or counterproductive. You can react with 👍 and 👎 on @gemini-code-assist comments. If you're interested in giving your feedback about your experience with Gemini Code Assist for GitHub and other Google products, sign up here.

Footnotes

1. Review the Privacy Notices, Generative AI Prohibited Use Policy, Terms of Service, and learn how to configure Gemini Code Assist in GitHub here. Gemini can make mistakes, so double check it and use code with caution. ↩

[gemini-code-assist]

Code Review

This pull request updates the configuration loading mechanism in the CLI to ensure that consolidated MCP server lists (allowed and excluded) are correctly used across all settings scopes. Specifically, AcpSessionManager now passes loadedSettings to loadCliConfig, which in turn utilizes getConsolidatedAllowedMcpServers() and getConsolidatedExcludedMcpServers() to prevent workspace-scoped settings from overriding user-level configurations. No review comments were provided for this pull request.

[gemini-cli]

Hi there! Thank you for your interest in contributing to Gemini CLI.

To ensure we maintain high code quality and focus on our prioritized roadmap, we only guarantee review and consideration of pull requests for issues that are explicitly labeled as 'help wanted'.

This PR will be closed in 7 days if it remains without that designation. We encourage you to find and contribute to existing 'help wanted' issues in our backlog! Thank you for your understanding.

[gemini-cli]

This pull request is being closed as it has been open for 14 days without a 'help wanted' designation. We encourage you to find and contribute to existing 'help wanted' issues in our backlog! Thank you for your understanding.