VSCode at least prompts you to trust the project folder before running anything, otherwise it will use a globally installed LSP.