MCPIgnore Filesystem MCP Server with .mcpignore Access Control

Overview

The MCPIgnore Filesystem MCP Server is a file-backed Model Context Protocol (MCP) server that enforces access control using .mcpignore files placed alongside your filesystem content. It prevents MCP clients from reading or traversing files and directories that match deny patterns, enabling safer sharing of local or mounted data with models and AI tooling while keeping sensitive artifacts inaccessible.

This approach is useful when you need to expose a filesystem to models (for retrieval, context augmentation, or data-access tools) but must avoid leaking secrets, credentials, or private artifacts. By adopting a simple, gitignore-like syntax, .mcpignore provides a developer-friendly way to specify which paths are off-limits to MCP clients without changing your existing deployment or storage layout.

Features

• .mcpignore-based access control with a familiar pattern syntax
• Per-directory ignore files, resolved from the requested path upward
• Support for glob patterns, negation (!), and comments
• Configurable server root directory and runtime options
• Simple CLI for local testing and integration into CI/CD
• Logging and diagnostic output for auditing access decisions

Installation / Configuration

Clone the project and run the server. The repository includes a compiled binary for many platforms; you can also build from source.

Clone and build from source:

git clone https://github.com/CyberhavenInc/filesystem-mcpignore.git
cd filesystem-mcpignore
# If the project is Go-based:
go build ./cmd/mcp-server -o mcp-server

Run the server (example):

# serve the /data directory on port 8080
./mcp-server --root /data --port 8080 --log-level info

Example configuration (JSON/YAML-style; server accepts CLI flags or a config file):

root: /data
port: 8080
log_level: info
follow_symlinks: false
max_file_size_bytes: 10485760  # 10 MB

Configuration options (summary):

Note: Exact CLI flags and config keys may vary; consult the repo’s README or binary --help for authoritative details.

.mcpignore: Syntax and Semantics

.mcpignore files use a simple, familiar syntax similar to .gitignore:

• Blank lines and lines starting with # are ignored (comments).
• foo matches files or directories named foo anywhere in the same directory.
• build/ matches a directory named build.
• *.key matches any file with .key extension.
• !important.key negates a previous pattern (allows access).
• Leading slash /secret matches paths relative to the directory containing the .mcpignore file.

Example .mcpignore:

# deny keys and environment files
*.key
.env

# deny the private config directory
private/

# allow special key needed by the model
!important.key

Precedence: the server resolves ignore files by walking from the requested path up to the root, combining patterns. Later rules can override earlier ones via negation.

Available Resources

• Project repository: https://github.com/CyberhavenInc/filesystem-mcpignore
• Issue tracker and feature requests: Use the repository Issues page
• Example content and test cases: see the examples/ or tests/ directory in the repo
• Binary help: ./mcp-server --help for runtime flags and usage

Use Cases

• Protecting secrets in a codebase

  • When providing a local code repository to a code-aware model, place .mcpignore at the repo root to deny access to .env, secrets/, or SSH keys while exposing source files.

• Multi-tenant data hosting

  • Host a shared dataset directory for multiple models but use per-tenant .mcpignore files to prevent clients from reading other tenants’ directories or metadata files.

• CI/CD and safe evaluation

  • Expose build artifacts to a model-based test runner but block access to credentials or internal tooling using .mcpignore, ensuring test-time model queries cannot leak sensitive information.

• Gradual rollout and auditing

  • Start by ignoring highly sensitive patterns (e.g., *.pem, credentials.json), then iterate based on audit logs. The server logs access denials to help tune ignore rules.

Examples

Deny .pem files anywhere under the root:

*.pem

Deny everything under secrets/ but allow a specific file:

secrets/
!secrets/public.json

Place a .mcpignore in /data/project/ to restrict that project only:

# /data/project/.mcpignore
.env
build/
*.key

Security Notes

• .mcpignore patterns are evaluated before serving content. Files matched by deny patterns will not be readable by MCP clients.
• Avoid symlink escapes: set follow_symlinks: false unless you intentionally want symlink resolution; symlinks may allow access outside the root.
• Combine server-level options (root, max file size) with .mcpignore to limit exposure.

For full implementation details, usage examples, and issues, see the repository at https://github.com/CyberhavenInc/filesystem-mcpignore.