A repository commits a settings file that approves its own MCP servers, so that teammates are not interrupted. A colleague clones it, starts a session, and finds the servers sitting unapproved. Why?

The principle — A trust decision that the untrusted thing can make for itself is not a trust decision.

Why the key is correct — A cloned repository cannot approve its own servers: the approval settings committed to the project are ignored in an untrusted folder, and the server stays pending instead of being connected and health-checked. Trusting the workspace is a separate act by the person, and it has to come first.

Why the others are wrong — The clone is complete; the setting is simply not consulted. The folder does not merely prompt more often, it disregards the setting. And pending is not a working state — the server is neither connected nor checked.

Remember this — A repository cannot vouch for itself, which is the whole point of asking you instead. Trusting the workspace is the step that has to come from a person, and until it does the committed setting has no effect at all.

Sources — Anthropic's Claude Code MCP reference.