GATE008: Sensitive filesystem path exposed to agent

An agent is granted access to a directory that holds credentials or system configuration.

Name
Severity
Type
Critical
Description
Default severity. An individual finding may be reported higher or lower when the surrounding configuration justifies it.
Name
Capabilities
Type
secrets, read
Description
Capability classes this rule reasons about.
Name
Explain locally
Type
gate explain GATE008
Description
The same text, in your terminal, with no network access.

What Gate detected

Gate found a configured filesystem grant that resolves to a known-sensitive location: ~/.ssh, ~/.aws, ~/.config/gcloud, ~/.kube, ~/.gnupg, ~/.docker, ~/.npmrc, the whole home directory, the filesystem root, a system directory such as /etc, or a .env file. Home-relative forms (~, $HOME, %USERPROFILE%) are expanded before matching.

Why this matters

These directories are where the machine keeps the keys to everything else. An agent that can read ~/.ssh can be induced to disclose the private keys that authenticate to your servers and your git host; one that can read ~/.aws holds your cloud account. The agent does not need to be malicious for this to matter: it only needs to encounter text that tells it to summarise a file, and the file is a private key.

This is the finding where the "small blast radius beats perfect intelligence" principle is clearest. No amount of model quality makes it safe to put a credential store inside an agent's reach; the fix is to move the boundary, not to trust the agent more.

Example

This is the shape of configuration that triggers the rule.

{
  "mcpServers": {
    "filesystem": {
      "command": "npx",
      "args": ["-y", "@modelcontextprotocol/server-filesystem", "/Users/me"]
    }
  }
}

And a safer version of the same thing:

{
  "mcpServers": {
    "filesystem": {
      "command": "npx",
      "args": [
        "-y",
        "@modelcontextprotocol/server-filesystem",
        "/Users/me/code/this-project"
      ]
    }
  }
}

Remediation

Narrow the grant to the specific project directory the agent works in. If the agent genuinely needs a credential, hand it that one credential through the environment rather than handing it the directory the credential lives in.

Suppressing this rule

If this finding is acceptable in your repository, record why alongside the suppression:

gate.config.ts

export default defineConfig({
  ignore: [
    {
      rule: 'GATE008',
      reason: 'Why this is acceptable here',
    },
  ],
})

Gate refuses to apply an ignore entry with no reason. The reason is the only thing that will tell the next person whether the suppression is still true.