F
MCP server · Files
Govern the Filesystem MCP server.
The Filesystem MCP server gives an agent local disk access. Pin it to a sandbox path and deny writes outside it.
Per-tool policy
An MCP server is a bag of tools. Enable them one at a time.
Connect Filesystem once; HiveKey gates each tool per role. Read-only by default, writes on purpose, destructive ops denied.
mcp / filesystem governed
read_file allow
list_directory allow
write_file review
delete_file deny
move_file review
Confine to a sandbox directory; deny reads/writes of secrets and system paths.
In the path
HiveKey sits between the agent and Filesystem.
Agent
wants a tool call
HiveKey
scope · guard · log
Filesystem MCP
only allowed tools
Put the Filesystem MCP server under one policy.
Connect Filesystem, gate each tool per role, and log every call — across your whole agent fleet.