Know the defaults

dir2mcp starts from a private posture. The server binds to loopback, creates a bearer token, and excludes its own state, environment files, keys, certificates, and Git metadata from indexing.

Network: 127.0.0.1 by default, with browser-origin and host checks.
Authentication: an auto-generated token unless another secure source is selected.
Root isolation: tool paths stay inside the corpus and reject traversal or symlink escapes.
Provider traffic: redirect following is disabled so credentials stay on the configured host.

Public mode

--public refuses to start without authentication unless--force-insecure is also supplied. Treat that override as an explicit acceptance of exposure, never as normal deployment configuration.

Keep credentials out of config

Store provider keys in the environment, OS keychain, or a local dotenv file. Resolution uses the first non-empty value in this order: environment, keychain, then local dotenv files. Secret values are not written into effective config snapshots.

dir2mcp config set-secret MISTRAL_API_KEY

dir2mcp config secrets

The second command reports which supported credentials are available without printing their values. For unattended services, use a protected environment file because a locked desktop keychain may not be accessible at login.

Verify a fully local path

Bind every active capability to an endpoint you run, pin document extraction to local docling or a local docling server, and omit cloud credentials. Then ask the runtime to verify the resolved routes:

dir2mcp doctor

The egress check should report that all resolved providers target loopback, private-network, or trusted LAN addresses. If it names a public host, at least one capability still leaves the trust boundary.

Control what enters the index

Default path exclusions cover common credential files, but a customsecurity.path_excludes list replaces those defaults. Copy the safe patterns into any replacement and add corpus-specific exclusions. Classification also refuses dotenv files and private keys independently of that list.

Retrieved documents are wrapped as untrusted data before answer generation. A custom system prompt cannot remove that guard, preventing indexed instructions from silently replacing the server's grounding rules.

Share diagnostics safely

A support bundle removes tokens, authorization headers, URL credentials, and query or fragment values in every mode. Local paths, titles, endpoints, prompts, and operator-written patterns are also removed unless content inclusion is explicitly requested.

dir2mcp support-bundle

The archive is written atomically with owner-only permissions. Review thefull disclosure guidebefore attaching it to a public issue. Report vulnerabilities privately throughGitHub Security Advisories.