Repository navigation
sysknife-setup's .gitignore check is a substring match, so a comment naming .mcp.json hides the API-key warning #562
Description
sysknife-setup writes the provider API key in plain text into .mcp.json and .cursor/mcp.json in the current directory, then checks .gitignore with a substring match. A comment or a negation that mentions the file name suppresses the warning.
What happens
packages/setup/index.js:719-726puts the typed key into each server'senv, and lines 766 and 804 write.mcp.jsonand.cursor/mcp.jsonin the working directory.- Lines 881-893 print "Consider adding these to .gitignore", gated on
gitignore.includes('.mcp.json'),includes('*.local.md')andincludes('.cursor/mcp.json').
A .gitignore line like # .mcp.json lives in my home dir, or !.mcp.json, or .mcp.json.bak, contains the substring, so no warning prints, and the file is not ignored. The next git add -A commits the key.
The key prompt at line 631 uses a plain readline ask, so the key is also echoed to the terminal.
Fix
- When a key is embedded and the directory is inside a git work tree, ask git:
git check-ignore -q -- .mcp.json. If it is not ignored, append the entry to.gitignoreand print that you did, or refuse with a clear message. I prefer appending. - Read the key with echo off.
Done when
Tests with a .gitignore holding the comment form, the negation form and the longer-name form all end with the file ignored (or the wizard refusing). Use a temporary git repo in the test, and fake key values.
Nearest existing: #526 (uninstall leaves a file holding a key behind).
Getting started
CONTRIBUTING.md has the build and test commands. No CLA and no copyright waiver. The project is MIT.
Activity
vladimirrott commentedon Oct 1, 2026
@Osheun This is a small, self-contained fix in the setup wizard: swap the substring check for git check-ignore. I'm holding it for you if you want it.
vladimirrott commentedon Oct 13, 2026
@Osheun I held this for you on 1 October and I'm returning it to the pool so another contributor can take it. It's yours again on request, and nothing is owed either way.
vladimirrott commentedon Oct 19, 2026
@CreedTech this is in the same file as your #610 and the same kind of fix. sysknife-setup checks whether .mcp.json is gitignored with a substring match, so a comment in .gitignore that merely names the file hides the API-key warning. The setup test harness you just used is the place to pin it. It is yours if you want it; reply here and I will assign it.
vladimirrott commentedon Oct 21, 2026
#610 shifted the second half of
index.jsby five lines, so I updated the body: the.cursor/mcp.jsonwrite is at 804 (was 799) and the.gitignorewarning block at 881-893 (was 876-888). Lines 631, 719-726 and 766 did not move. Also added a Getting started section. The substring check is still there ated7c59da(index.js:881).