MCP-autostart RCE class is mostly DEFENDED across the ecosystem; continue is the outlier; zed Worktree Trust = the reference fix

Banked: 2026-07-14, cycle310 (swept zed + void for the MCP-autostart class; both WALK/SAFE. continue [cycle309] remains the sole confirmed).

Sweep result (the class is near-closed - continue is the yield)

Workspace-committed MCP config -> auto-spawn command -> repo-open RCE. Across surveyed clients: - continue = VULNERABLE (workspace .continue/mcpServers/* walked + auto-spawn + NO gate). The outlier. - cline = SAFE - MCP config GLOBAL-user-only (not repo-shippable). - void = SAFE - own MCP config global-only; .voidrules is prompt-text (no spawn); inherited VS Code native MCP is workspace-trust-gated (isTrustedByDefault:false + trust dialog + manual StartServer). (Also archived 2026-06-02.) - zed = SAFE + already fixed - had the EXACT bug, patched via Worktree Trust (GHSA-cv6g-cmxc-vw8j + LSP GHSA-29cp-2hmh-hcxj + .git/config GHSA-fj2r-rmw6-h222). - Amazon Q / Claude Code / Cursor = fixed (CVE-2026-12957 / -59536 / -48124). => The class SATURATED fast (most clients gate it or were CVE'd). Sweeping more clients is now LOW-EV. continue is the exception because it has NO workspace-trust concept at all.

This STRENGTHENS the continue finding (peer-outlier framing)

"Every peer client gates workspace-declared MCP servers (global-only source, or workspace-trust, or fingerprint-consent); continue alone auto-spawns with no gate" = kills the by-design rebuttal + hands the maintainer 2 working fix references (zed Worktree Trust, Amazon Q fingerprint-consent). Folded into cycle309 00-finding.md.

Two reference defenses banked (Securva MCP-audit + disclosure remediation)

zed Worktree Trust / Restricted Mode (defaults-closed project-settings trust: .zed/settings.json MCP/LSP/task configs don't apply until the worktree is trusted). The cleanest "untrusted-project" model - cite for ANY editor-that-runs-project-config finding.
VS Code native MCP workspace-trust (workspace MCP collections isTrustedByDefault:false + explicit trust dialog + StartServer action). Reusable audit rubric: a client that runs ANYTHING declared by a project file (MCP servers, LSP binaries, tasks, formatters, git hooks) MUST gate it behind project/worktree trust. zed's GHSA cluster (MCP + LSP + .git/config, all same root) shows this is a FAMILY - audit all project-config->exec surfaces together, not just MCP.

Stop-condition

MCP-autostart sweep = DONE (continue is the yield; peers gate it). Do NOT sweep more clients for this specific class. The higher-EV adjacent hunt = the BROADER "project-config -> exec without trust" family (LSP binary path, task runners, formatters, git hooks declared in repo config) on clients that LACK a worktree-trust concept - continue (no trust concept) is the prime candidate for THOSE siblings too.