A project's .zero/ config — hooks, plugins, and MCP server definitions — is loaded and run as soon as Zero starts in that directory. So if you clone or check out someone else's repo and run a single tool, their hook/plugin/MCP command executes outside the sandbox with no prompt. That's a silent code-execution path on any untrusted repo.
We should gate project-scoped hooks, plugins, and MCP servers behind an explicit per-workspace trust decision — fail closed until the workspace is trusted, with a clear one-time prompt/notice. #529 implements this.
A project's
.zero/config — hooks, plugins, and MCP server definitions — is loaded and run as soon as Zero starts in that directory. So if you clone or check out someone else's repo and run a single tool, their hook/plugin/MCP command executes outside the sandbox with no prompt. That's a silent code-execution path on any untrusted repo.We should gate project-scoped hooks, plugins, and MCP servers behind an explicit per-workspace trust decision — fail closed until the workspace is trusted, with a clear one-time prompt/notice. #529 implements this.