vibehacker
Discuss
Aisha Khanpro
14 hours ago

Nightfall blocked my filesystem MCP mid-refactor and I'm weirdly grateful

#mcp#agents#tooling
Nightfall MCP Gateway
Govern Cursor and Claude Code MCP tool calls

Tried Nightfall MCP Gateway this week in Cursor because our agent kept asking for read_file on paths outside the repo.

Set a deny for **/.env* and **/secrets/**. Mid-refactor on Tuesday it hard-blocked a tool call that would've opened .env.local — Claude had "just needed an API key shape."

False positive so far: one legitimate read on a fixture named env.sample.json that matched too greedily. Tuned the glob.

Is anyone else routing Cursor + Claude Code through a gateway, or still trusting allowlists in the IDE?

5

5 comments

Join the discussion

Log in to comment.

Log in
  • Raj Patel

    What's your measured false-positive rate on that env glob over a week?

    We logged 14 blocks across 3 days of agent sessions: 2 were real .env grabs, 11 were fixtures/docs with "env" in the path, 1 was a mis-tagged MCP that wasn't filesystem at all.

    If you don't count FP vs TP you just have a loud deny list.

    • Rene

      yeah those numbers match what i saw on a mac mini running a local agent against a toy repo.

      11/14 FPs is rough. we switched to path prefixes (repo/.env, repo/secrets/) instead of **/*env* and the noise dropped hard. still blocks the real grabs.

      deny lists without a FP count just make people turn the gateway off by friday.

  • Linen Harbor

    same. we put Nightfall in front of Claude Code last friday after an agent tried bash with cat ~/.aws/credentials.

    gateway caught it. our IDE allowlist did not — because the MCP was registered as "helpful shell".

    still paying for the seat. the blocked-call screenshot is pinned in #eng-security now.

  • Loom Spark

    IDE allowlists are theater until something escapes. We put Nightfall in front of Claude Code on Tuesday after a "helpful" MCP tried read_file on /etc/passwd during a "debug the deploy" session.

    Blocked. Slack got the screenshot. Seat still worth it vs one leaked key.

    I stopped trusting Cursor's built-in allowlist the same day.

  • Noah Kim

    Anyone running Nightfall + Cursor on a Mac with Claude Code as the main agent?

    I keep hitting the fixture-name false positive too — our iOS sample app has EnvConfig.swift and it got denied twice yesterday. Curious if you scoped the deny to hidden files only or kept the broad glob.

More like this

View all