Stopping a Filesystem MCP Server From Reading .env Files

Description and use

Agentgateway’s filesystem MCP can read .env and other credential files inside a sandbox because its built‑in policy cannot inspect the path argument. Adding an external policy server via ExtMCP lets the policy check the path and block reads of credential‑bearing files, preventing secret leakage.

Problem

A filesystem MCP server scoped to a directory still reads .env and other credential files if an agent requests them by path, exposing secrets.

Outcome

The guardrail successfully blocks reads of credential‑bearing files, as demonstrated by a rejected read of /sandbox/.env and an allowed read of the same file without the guardrail.

Workflow

• 1. Configure agentgateway with an mcpGuardrails policy pointing to a remote policy server.
• 2. The policy server implements CheckRequest to parse tool name and arguments.
• 3. For path‑bearing tools, the server checks each path against a denylist (e.g., .env, .ssh, .git/).
• 4. If a match is found, the server returns an AuthorizationError, causing the filesystem server to refuse the read.
• 5. The agent receives an error instead of file contents.

Evidence

Agentgateway has a built‑in MCP authorization policy: mcpAuthorization, CEL rules evaluated against mcp.tool.name, mcp.tool.target, and JWT claims like jwt.sub when authentication is configured.

Source

The server is about 150 lines of Python. CheckRequest parses the JSON‑RPC params, pulls name and arguments, and for path‑bearing tools checks every path string against a denylist.

Source

A match returns an AuthorizationError from CheckRequest, and the filesystem server never opens the file: … error code "error" message "path argument matches denied pattern '.env'; filesystem-mcp-env-guard blocks reads of credential-bearing paths"

Source