# Is SourceKit-LSP of Swift 6.4 asking for workspace trust? **URL:** \ **Category:** SourceKit-LSP\ **Created:** [August 12, 2026, 9:23am UTC](https://forums.swift.org/t/is-sourcekit-lsp-of-swift-6-4-asking-for-workspace-trust/88934 "2026-08-12T09:23:55Z")\ **Posts on this page:** 9\ **Page:** 1
**Author:** ![jansorg](https://sea2.discourse-cdn.com/swift/user_avatar/forums.swift.org/jansorg/32/42900_2.png) [@jansorg](https://forums.swift.org/u/jansorg)\ **Post date:** [August 12, 2026, 9:23am UTC](https://forums.swift.org/t/is-sourcekit-lsp-of-swift-6-4-asking-for-workspace-trust/88934/1 "2026-08-12T09:23:55Z")
I tested SourceKit-LSP of Xcode 27.0 Beta 5. This prompt was shown shortly after launching the LSP server and it's not part of my own plugin. So I suppose that it's from the LSP server. The setup was SourceKit-LSP with an xcode-build-server setup in an Xcode workspace. - It this from SourceKit LSP? - This is potentially confusing because users would expect a reference to the language support plugin (Noctule in this case) and JetBrains IDEs already have a separate workspace trust configuration. Is there a way to customize and/or turn this off? - How can I reset the state for testing it some more? I search the GitHub repo, but couldn't find the answers. Thank you! ![Screenshot_20260812_110053](https://global.discourse-cdn.com/swift/original/3X/f/1/f1adf279034a9b05b8bddd224d5567905e173e44.jpeg) ---
**Author:** ![rintaro](https://sea2.discourse-cdn.com/swift/user_avatar/forums.swift.org/rintaro/32/568_2.png) [@rintaro](https://forums.swift.org/u/rintaro)\ **Post date:** [August 17, 2026, 9:46pm UTC](https://forums.swift.org/t/is-sourcekit-lsp-of-swift-6-4-asking-for-workspace-trust/88934/2 "2026-08-17T21:46:44Z")
Yes, this is from sourcekit-lsp. As the message says, this is asking whether to trust the workspace's `.bsp/` or `.sourcekit-lsp/` settings. Until you trust it, the workspace is open without loading those files. This is currently only implemented in `sourcekit-lsp` bundled in Xcode beta. I'm going to upstream it in the GitHub repo soon. ---
**Author:** ![krzyzanowskim](https://sea2.discourse-cdn.com/swift/user_avatar/forums.swift.org/krzyzanowskim/32/1282_2.png) [@krzyzanowskim](https://forums.swift.org/u/krzyzanowskim)\ **Post date:** [August 17, 2026, 10:08pm UTC](https://forums.swift.org/t/is-sourcekit-lsp-of-swift-6-4-asking-for-workspace-trust/88934/3 "2026-08-17T22:08:20Z")
how to disable it? is LSP server expected to display UI to the user without the notifications system? ---
**Author:** ![rintaro](https://sea2.discourse-cdn.com/swift/user_avatar/forums.swift.org/rintaro/32/568_2.png) [@rintaro](https://forums.swift.org/u/rintaro)\ **Post date:** [August 17, 2026, 10:57pm UTC](https://forums.swift.org/t/is-sourcekit-lsp-of-swift-6-4-asking-for-workspace-trust/88934/4 "2026-08-17T22:57:05Z")
> [@krzyzanowskim](#): > > how to disable it? In your `~/.sourcekit-lsp/config.json` ```swift { "bypassWorkspaceTrust": true } ``` > [@krzyzanowskim](#): > > is LSP server expected to display UI to the user without the notifications system? The standard LSP has a mechanism to show a message and ask for the answer from the client. [`window/showMessageRequest`](https://microsoft.github.io/language-server-protocol/specifications/lsp/3.17/specification/#window_showMessageRequest) was introduced in [2016](https://github.com/microsoft/language-server-protocol/commit/bb1f1c715752a24b5949cc75870e2419a1fb4684) for LSP 2.x and is not client capability gated. ---
**Author:** ![jansorg](https://sea2.discourse-cdn.com/swift/user_avatar/forums.swift.org/jansorg/32/42900_2.png) [@jansorg](https://forums.swift.org/u/jansorg)\ **Post date:** [August 18, 2026, 9:16am UTC](https://forums.swift.org/t/is-sourcekit-lsp-of-swift-6-4-asking-for-workspace-trust/88934/5 "2026-08-18T09:16:25Z")
Thank you for your reply! I understand why it was added, but from my perspective as a 3rd-party integrating SourceKit LSP I have to say that I don't like it that much. - The message is potentially confusing because it's unclear what happens if "Don't Trust" is selected. I don't think a user knows that completions, go to definition, etc. will stop working. - If a user selected "Don't Trust" there's no way to ask SourceKit-LSP to show this again. At least there's no way I'm aware of. Instead, every LSP client / integration has to implement to locate the user's `~/.sourcekit-lsp/config.json` to allow a user to change the trust setting again. - Isn't this duplicating the IDE's trust settings of VSCode, JetBrains and others? Questions: - Is only the SourceKit-LSP configuration in the user's home directory used to read setting `bypassWorkspaceTrust` or can this be configured in a directory's `.sourcekit-lsp/config.json`, too? The IDE has its own trust setting setup already and I could apply the user's trust choice in the configuration, if supported. ---
**Author:** ![dima\_kozhinov](https://avatars.discourse-cdn.com/v4/letter/d/258eb7/32.png) [@dima\_kozhinov](https://forums.swift.org/u/dima_kozhinov)\ **Post date:** [August 18, 2026, 10:18am UTC](https://forums.swift.org/t/is-sourcekit-lsp-of-swift-6-4-asking-for-workspace-trust/88934/6 "2026-08-18T10:18:34Z")
Will this message appear in any case, or only when specific settings are specified in `.bsp/` or `.sourcekit-lsp/`? I don't use any settings in these folders (and specify all settings via command-line), will I receive this message in Swift 6.4? Can I specify `bypassWorkspaceTrust` via command-line when I start the sourcekit-lsp executable? What will happen if a client editor is not capable of `showMessageRequest`? I guess sourcekit-lsp will silently fail to access the workspace folder? ---
**Author:** ![rintaro](https://sea2.discourse-cdn.com/swift/user_avatar/forums.swift.org/rintaro/32/568_2.png) [@rintaro](https://forums.swift.org/u/rintaro)\ **Post date:** [August 18, 2026, 9:01pm UTC](https://forums.swift.org/t/is-sourcekit-lsp-of-swift-6-4-asking-for-workspace-trust/88934/7 "2026-08-18T21:01:23Z")
> [@jansorg](#): > > - The message is potentially confusing because it's unclear what happens if "Don't Trust" is selected. I don't think a user knows that completions, go to definition, etc. will stop working. Suggestions for clearer wording would be very welcome! > [@jansorg](#): > > - If a user selected "Don't Trust" there's no way to ask SourceKit-LSP to show this again. At least there's no way I'm aware of. Instead, every LSP client / integration has to implement to locate the user's `~/.sourcekit-lsp/config.json` to allow a user to change the trust setting again. If the user answers "Trust Workspace", the decision is persisted in `~/.sourcekit-lsp/trusted-workspaces.json`. However, a "Don't Trust" response is not persisted, so the user can restart the client to be prompted again. > [@jansorg](#): > > - Isn't this duplicating the IDE's trust settings of VSCode, JetBrains and others? Yes, that's one of the reasons we implemented the opt-out mechanism. Clients that already have their own workspace trust mechanism may want to bypass SourceKit-LSP's workspace trust checks. Such clients can set `initializationOptions.bypassWorkspaceTrust` to `true` in the `initialize` request. > [@jansorg](#): > > - Is only the SourceKit-LSP configuration in the user's home directory used to read setting `bypassWorkspaceTrust` or can this be configured in a directory's `.sourcekit-lsp/config.json`, too? The IDE has its own trust setting setup already and I could apply the user's trust choice in the configuration, if supported. No, `bypassWorkspaceTrust` cannot be specified in a workspace's `.sourcekit-lsp/config.json`, because that would defeat the whole purpose of the workspace trust mechanism. Alternatively, `sourcekit-lsp` provides the `--bypass-workspace-trust` command-line option. > [@dima\_kozhinov](#): > > Will this message appear in any case, or only when specific settings are specified in `.bsp/` or `.sourcekit-lsp/`? I don't use any settings in these folders (and specify all settings via command-line), will I receive this message in Swift 6.4? Only if there's a `.bsp/` or `.sourcekit-lsp/` directory in the workspace root. If neither directory exists, the dialog is not displayed and all functionality should work as usual. > [@dima\_kozhinov](#): > > Can I specify `bypassWorkspaceTrust` via command-line when I start the sourcekit-lsp executable? You can pass `--bypass-workspace-trust` when launching `sourcekit-lsp`. > [@dima\_kozhinov](#): > > What will happen if a client editor is not capable of `showMessageRequest`? I guess sourcekit-lsp will silently fail to access the workspace folder? If the `window/showMessageRequest` server-to-client request returns an error, it is treated as "Don't Trust". ---
**Author:** ![jansorg](https://sea2.discourse-cdn.com/swift/user_avatar/forums.swift.org/jansorg/32/42900_2.png) [@jansorg](https://forums.swift.org/u/jansorg)\ **Post date:** [August 19, 2026, 8:09am UTC](https://forums.swift.org/t/is-sourcekit-lsp-of-swift-6-4-asking-for-workspace-trust/88934/8 "2026-08-19T08:09:13Z")
> [@rintaro](#): > > > [@jansorg](#): > > > > - The message is potentially confusing because it's unclear what happens if "Don't Trust" is selected. I don't think a user knows that completions, go to definition, etc. will stop working. > > Suggestions for clearer wording would be very welcome! While thinking about different wording, it occurred to me that multiple workspace directories can be set up by an LSP client. If 3 separate workspace are passed in the init, will this message show all three names? That could become a long, unreadable list in the worst case... Or would $n messages appear for $n workspace directories? That wouldn't be helpful, either ;) For the message: - I'd add a line break after `Do you trust the authors of files in "$name"?` because it's the main question - In my setup it wasn't a `.bsp/` directory, but a `buildServer.json` file (xcode-build-server does not use the new directory setup yet). - I'd also add a line break before `Only trust workspaces from sources you trust.` - `Only trust workspaces from sources you trust.` has "trust" twice. Perhaps changes to something like `Only trust workspaces from sources you know.`? - I'd add something like "Code completion, navigation and other features are only available in workspaces you trust`. (I'm not a native speaker, just a suggestion) I'm not sure which features would be turned off, but assume that most would be made unavailable. > [@rintaro](#): > > > [@jansorg](#): > > > > - If a user selected "Don't Trust" there's no way to ask SourceKit-LSP to show this again. At least there's no way I'm aware of. Instead, every LSP client / integration has to implement to locate the user's `~/.sourcekit-lsp/config.json` to allow a user to change the trust setting again. > > If the user answers "Trust Workspace", the decision is persisted in `~/.sourcekit-lsp/trusted-workspaces.json`. However, a "Don't Trust" response is not persisted, so the user can restart the client to be prompted again. Thanks for the details, that's helpful! Details on the implementation would be great to have in the sourcekit-lsp GitHub repo. > [@rintaro](#): > > > [@jansorg](#): > > > > - Isn't this duplicating the IDE's trust settings of VSCode, JetBrains and others? > > Yes, that's one of the reasons we implemented the opt-out mechanism. Clients that already have their own workspace trust mechanism may want to bypass SourceKit-LSP's workspace trust checks. Such clients can set `initializationOptions.bypassWorkspaceTrust` to `true` in the `initialize` request. Ah, the initialization option is what I need. > [@rintaro](#): > > > [@jansorg](#): > > > > - Is only the SourceKit-LSP configuration in the user's home directory used to read setting `bypassWorkspaceTrust` or can this be configured in a directory's `.sourcekit-lsp/config.json`, too? The IDE has its own trust setting setup already and I could apply the user's trust choice in the configuration, if supported. > > No, `bypassWorkspaceTrust` cannot be specified in a workspace's `.sourcekit-lsp/config.json`, because that would defeat the whole purpose of the workspace trust mechanism. > > Alternatively, `sourcekit-lsp` provides the `--bypass-workspace-trust` command-line option. Thanks! I won't be able to use the command-line option because (I suppose) it can not be used with swift \< 6.4. I'd like to avoid version-checking the binaries first before building the command line options. The initialization option seems like the best way for my setup, I think. Thank you for your reply and your time to provide details on how it works! ---
**Author:** ![krzyzanowskim](https://sea2.discourse-cdn.com/swift/user_avatar/forums.swift.org/krzyzanowskim/32/1282_2.png) [@krzyzanowskim](https://forums.swift.org/u/krzyzanowskim)\ **Post date:** [September 10, 2026, 11:10pm UTC](https://forums.swift.org/t/is-sourcekit-lsp-of-swift-6-4-asking-for-workspace-trust/88934/9 "2026-09-10T23:10:54Z")
I just noticed that `bypassWorkspaceTrust` is not available anywhere in the Open Source version [GitHub - swiftlang/sourcekit-lsp: Language Server Protocol implementation for Swift and C-based languages ยท GitHub](https://github.com/swiftlang/sourcekit-lsp) is that intentional?