GATE009: Filesystem access extends beyond the repository

An agent is granted filesystem access outside the repository being scanned.

Name
Severity
Type
High
Description
Default severity. An individual finding may be reported higher or lower when the surrounding configuration justifies it.
Name
Capabilities
Type
read, write
Description
Capability classes this rule reasons about.
Name
Explain locally
Type
gate explain GATE009
Description
The same text, in your terminal, with no network access.

What Gate detected

Gate found a filesystem grant whose resolved path is outside the scanned repository and which is not one of the specifically sensitive locations covered by GATE008. Paths inside the repository are not reported: that is the expected configuration.

Why this matters

A coding agent needs the project. It rarely needs the parent directory, and it almost never needs the whole disk. Every directory beyond the project is a directory nobody considered when they decided this agent was safe: other repositories, other clients' code, downloaded files, backups, notes.

The scope also determines what an attacker gets. With a workspace-scoped agent, a successful prompt injection reads one project. With a home-scoped agent, it reads everything you have ever worked on.

Example

This is the shape of configuration that triggers the rule.

{
  "mcpServers": {
    "filesystem": {
      "command": "npx",
      "args": ["-y", "@modelcontextprotocol/server-filesystem", "/", "/Users/me/Documents"]
    }
  }
}

Remediation

Scope the grant to the project directory. Where an agent needs a shared resource outside the project, mount that one directory explicitly and read-only rather than widening the root.

Suppressing this rule

If this finding is acceptable in your repository, record why alongside the suppression:

gate.config.ts

export default defineConfig({
  ignore: [
    {
      rule: 'GATE009',
      reason: 'Why this is acceptable here',
    },
  ],
})

Gate refuses to apply an ignore entry with no reason. The reason is the only thing that will tell the next person whether the suppression is still true.