Dicey Table
Docs
Search the docs

Stay in control

Which local files an agent can read

Only files inside folders you allow. The bridge reads them, never the browser, and it refuses hidden files, scripts and anything over 128 MB.

3 min readVerified

View as Markdown
On this page8 sections

Only files inside the folders you allow. By default that is the folder your AI client started the bridge in, plus any folder you add with --allow-dir. The bridge reads them, never the browser, and it refuses hidden files, scripts and anything over 128 MB.

We call this the folder fence. It applies when an agent imports assets from your computer, and when it saves a screenshot or a download back to disk.

Why the fence is strict#

A game's files live in a public GitHub repository, so anyone can read them. An agent reads a lot of text other people wrote, and some of it may try to trick it. If that happens, the agent still must not be able to put a private file into your game and publish it. Prompt injection protection covers that kind of trick.

So the fence follows a simple rule: the agent works only where you sent it.

Which folders are allowed#

  • The folder your AI client started the bridge in. For Claude Code, that is usually the project folder you opened. Some clients start the bridge somewhere else, so check before you rely on it.
  • Every folder you pass with --allow-dir. You can repeat the flag. A relative path is read from the folder the bridge started in.

If no allowed folder exists, every file call stops with no-roots.

How do I let the agent use another folder?#

Add --allow-dir to the bridge's arguments in your AI client's settings. For example:

Shell
npx -y @diceytable/mcp-bridge@1 --allow-dir /Users/sam/Art/game-assets

Use the full path, because most clients don't expand ~ for you. Your client's setup page shows where those arguments go. The bridge command line reference lists every flag. Allow the smallest folder that does the job. A folder of game art is a good choice. Your whole home folder is not.

What does the bridge refuse?#

Even inside an allowed folder, the bridge says no to some files. Each refusal has its own code, so the agent can tell you why.

Refused Code
A path whose real location is outside every allowed folder, including links and junctions that lead out outside-roots
Any file or folder whose name starts with a dot, like .env, .ssh or .git dot-path
A file type that isn't a game asset or a model format. Scripts are never allowed bad-extension
A file over 128 MB. The bridge checks the size before it reads a byte too-large
Windows device paths, network paths and NTFS alternate streams bad-path
A save that would replace a file that already exists exists

The bridge also checks the first bytes of each file against its name. A .png that is really a web page is refused.

Importing a whole folder#

An agent can import a folder of data files at once, such as the card lists a game script reads. That reads only .json, .txt and .csv files. It skips dot names, never follows links, and stops 16 folders deep. It reads 500 files and 64 MB by default, and never more than 2,000 files or 128 MB.

The folder must sit inside an allowed folder, not be one. So "import everything I allowed" is never a single call. Images, models and sounds go in one file at a time, each with its own credit.

AI models for game bots#

An .onnx file is an AI model a game's bots can run. asset_import refuses it. The agent uses ai_model_import instead, which reads only .onnx files, up to 64 MB, through the same fence. You confirm each model import in the tab. See actions that need your click.

Writing files back#

Some tools can save a copy to your computer with saveTo. A screenshot can be saved as a .png, .jpg, .webp or .gif. A URL import can save the file it downloaded, but only as a binary asset type, never as a text format like .json.

Every save goes inside an allowed folder, and the bridge never replaces a file that is already there. Pick a new name instead. Reading and writing both need the key's Local files permission, which you choose when you create an API key.

Did this page answer your question?