The yield is in a fresh CLASS on the same target, not a fresh target - MCP workspace-config autostart RCE (continue)

Banked: 2026-07-14, cycle309 (continue MCP-autostart RCE CONFIRMED; cline WALK). Corrects my premature "hunt lane is saturated -> stop" framing from cycle307/308.

The correction

After 3 fresh-CVE walks I concluded "the hunt lane is saturated." WRONG framing. The FILE-SYMLINK class was saturating; a DIFFERENT class (MCP workspace-config auto-start) on the SAME targets (continue) was fresh and yielded the session's highest-severity finding (repo-open RCE, High/Critical). Lesson: when one bug CLASS on a target saturates, PIVOT THE CLASS on the same well-understood target before abandoning it. Fresh-class-on-known-target > fresh-target-cold-start (you already have the codebase mapped + the threat model).

The class (hot + unswept across AI coding tools)

"Workspace-committed MCP config auto-loaded -> server command spawned WITHOUT consent = repo-open RCE." Disclosed 2026 for Amazon Q (CVE-2026-12957, fixed w/ fingerprint-triple consent), Claude Code (CVE-2025-59536), Cursor (CVE-2026-48124). The OSS/other clients are the unswept slice.

The reusable audit test (2 questions, cheap)

Config SOURCE: does the client load MCP configs from a WORKSPACE/repo-relative path (e.g. .continue/mcpServers/, .mcp.json, .vscode/) - repo-shippable = attack vector - or ONLY a GLOBAL user path (~/.config/...) - user-authored = safe? Grep the config-discovery for getWorkspaceDirs/workspaceFolders/cwd-joined config paths.
Auto-start + consent: on load, does it SPAWN the config's command (StdioClientTransport/child_process) WITHOUT a consent/trust/fingerprint gate? Grep the connect path for spawn/StdioClientTransport and grep for consent|trust|fingerprint|approve (ZERO hits = no gate). Both YES = RCE. Split verdict this cycle: continue = YES/YES (RCE); cline = NO (global-only config) -> safe (auto-spawns but source is user-authored). The config-SOURCE question is the FP-guard that separates them.

Product value (Securva MCP-audit)

"MCP config source (workspace vs global) + consent-before-spawn" is a core Securva MCP/agent-audit dimension. Add to the audit rubric alongside the 6-lens path-containment checklist (cycle306). A hardened client = global-only OR workspace-with-consent; a vulnerable one = workspace-shippable + auto-spawn.

Next sweep targets for THIS class (unswept): void, pearai, zed-agent, aide, goose (goose ships shell anyway), any MCP-enabled editor with project config. Apply the 2-question test + Gate-0 (class saturating fast - re-check disclosure per target right before staging).